i> 000000D8 Build: canary_experimental@99fd19d02 on Jun 5 2026 i> 000000D8 Storage root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug i> 000000D8 ----------- CONFIG DUMP ----------- [APU] apu = "any" apu_max_queued_frames = 8 enable_xmp = true ffmpeg_verbose = false mute = false use_dedicated_xma_thread = true xma_decoder = "new" [Auditing] audit_handle_lifecycle = true audit_jit_prolog_mem_dump = 0 audit_jit_prolog_pc = 2182918192 audit_jit_prolog_r3_bytes = 64 audit_track_event_handle = 0 [CPU] break_condition_gpr = -1 break_condition_op = "eq" break_condition_truncate = true break_condition_value = 0 break_on_debugbreak = true break_on_instruction = 0 break_on_start = false break_on_unimplemented_instructions = true clock_no_scaling = false clock_source_raw = false cpu = "any" debug_symbol_loader = false debugprint_trap_log = false disable_context_promotion = false disable_instruction_infocache = false disable_prefetch_and_cachecontrol = true disassemble_functions = false dump_translated_hir_functions = false elide_e0_check = false emit_inline_mmio_checks = false emit_mmio_aware_stores_for_recorded_exception_addresses = true emit_source_annotations = false enable_early_precompilation = false full_optimization_even_with_debug = false ignore_trap_instructions = true ignore_undefined_externs = true inline_loadclock = false inline_mmio_access = true load_module_map = "" no_reserved_ops = false no_round_to_single = false permit_float_constant_evaluation = false pvr = 7407360 record_mmio_access_exceptions = true store_all_context_values = false trace_function_coverage = false trace_function_data = false trace_function_data_path = "" trace_function_references = false trace_functions = false use_fast_dot_product = false validate_hir = false writable_code_segments = false [Config] defaults_date = 2026040912 [Content] license_mask = 0 [D3D12] d3d12_adapter = -1 d3d12_allow_variable_refresh_rate_and_tearing = true d3d12_bindless = true d3d12_break_on_error = false d3d12_break_on_warning = false d3d12_debug = false d3d12_dxbc_disasm = false d3d12_dxbc_disasm_dxilconv = false d3d12_pipeline_creation_threads = -1 d3d12_queue_priority = 1 d3d12_submit_on_primary_buffer_end = true d3d12_tessellation_wireframe = false [Display] fullscreen = false host_present_from_non_ui_thread = true postprocess_antialiasing = "" postprocess_dither = true postprocess_ffx_cas_additional_sharpness = 0 postprocess_ffx_fsr_max_upsampling_passes = 4 postprocess_ffx_fsr_sharpness_reduction = 0.20000000298023224 postprocess_scaling_and_sharpening = "" present_letterbox = true present_render_pass_clear = true present_safe_area_x = 100 present_safe_area_y = 100 [GPU] anisotropic_override = -1 async_shader_compilation = true clear_memory_page_state = false depth_float24_convert_in_pixel_shader = false depth_float24_round = false depth_transfer_not_equal_test = true disassemble_pm4 = false draw_resolution_scale_x = 1 draw_resolution_scale_y = 1 draw_resolution_scaled_texture_offsets = true dump_shaders = "" dxbc_source_map = false dxbc_switch = true execute_unclipped_draw_vs_on_cpu = true execute_unclipped_draw_vs_on_cpu_for_psi_render_backend = true execute_unclipped_draw_vs_on_cpu_with_scissor = false force_convert_line_loops_to_strips = false force_convert_quad_lists_to_triangle_lists = false force_convert_triangle_fans_to_lists = false framerate_limit = 0 gamma_render_target_as_unorm16 = true gpu = "any" gpu_3d_to_2d_texture = true gpu_allow_invalid_fetch_constants = true gpu_allow_invalid_upload_range = false half_pixel_offset = true ignore_32bit_vertex_index_support = false log_guest_driven_gpu_register_written_values = false log_ringbuffer_kickoff_initiator_bts = false mrt_edram_used_range_clamp_to_min = true native_2x_msaa = true native_stencil_value_output = true native_stencil_value_output_d3d12_intel = false no_discard_stencil_in_transfer_pipelines = false non_seamless_cube_map = true occlusion_query = "fast" occlusion_query_fake_lower_threshold = 80 occlusion_query_fake_upper_threshold = 100 occlusion_query_querybatch_range = 0 occlusion_query_saturation = 1 primitive_processor_cache_min_indices = 4096 readback_memexport = false readback_resolve = "none" render_target_path_d3d12 = "" render_target_path_vulkan = "" resolve_resolution_scale_fill_half_pixel_offset = true snorm16_render_target_full_range = true store_shaders = true target_trace_file = "" texture_cache_memory_limit_hard = 768 texture_cache_memory_limit_render_to_texture = 24 texture_cache_memory_limit_soft = 384 texture_cache_memory_limit_soft_lifetime = 30 tiled_shared_memory = true trace_dump_path = "" trace_gpu_prefix = "scratch/gpu/" trace_gpu_stream = false use_fuzzy_alpha_epsilon = false vsync = true [General] allow_game_relative_writes = false allow_plugins = false apply_patches = true controller_hotkeys = false debug = false disable_doubleclick_fullscreen = false discord = true launch_module = "" notification_sound_path = "" priority_class = 0 recent_titles_entry_amount = 10 time_scalar = 1 [HACKS] ac6_ground_fix = false [HID] guide_button = true hid = "any" keyboard_mode = 0 keyboard_user_index = 0 left_stick_deadzone_percentage = 0 right_stick_deadzone_percentage = 0 vibration = true [HID.WinKey] keybind_a = "0xBA" keybind_b = "0xDE" keybind_back = "Z" keybind_dpad_down = "^S" keybind_dpad_left = "^A" keybind_dpad_right = "^D" keybind_dpad_up = "^W" keybind_guide = "0x08" keybind_left_shoulder = "1" keybind_left_thumb = "F" keybind_left_thumb_down = "_S" keybind_left_thumb_left = "_A" keybind_left_thumb_right = "_D" keybind_left_thumb_up = "_W" keybind_left_trigger = "Q I" keybind_right_shoulder = "3" keybind_right_thumb = "K" keybind_right_thumb_down = "0x28" keybind_right_thumb_left = "0x25" keybind_right_thumb_right = "0x27" keybind_right_thumb_up = "0x26" keybind_right_trigger = "E O" keybind_start = "X" keybind_x = "L" keybind_y = "P" [Kernel] allow_avatar_initialization = false allow_incompatible_title_update = true apply_title_update = true cl = "" console_type = 0 default_achievements_backend = "GPD" ignore_thread_affinities = true ignore_thread_priorities = false kernel_build_version = 1888 kernel_cert_monitor = false kernel_debug_monitor = false kernel_display_gamma_power = 2.22222233 kernel_display_gamma_type = 2 kernel_pix = false staging_mode = false [Logging] enable_console = false flush_log = true log_file = "" log_high_frequency_kernel_calls = false log_level = 2 log_mask = 0 log_string_format_kernel_calls = false log_to_debugprint = false log_to_stdout = true [Memory] ignore_offset_for_ranged_allocations = false protect_on_release = false protect_zero = true scribble_heap = false scribble_heap_value = 0 writable_executable_memory = true [Profiles] logged_profile_slot_0_xuid = "" logged_profile_slot_1_xuid = "" logged_profile_slot_2_xuid = "" logged_profile_slot_3_xuid = "" [SDL] mappings_file = "gamecontrollerdb.txt" [Storage] cache_root = "" content_root = "" force_mount_devkit = false mount_cache = true mount_memory_unit = false mount_scratch = false storage_root = "" [UI] custom_font_path = "" font_size = 14 headless = false imgui_debug = false profiler_dpi_scaling = false show_achievement_notification = false show_profiler = false storage_selection_dialog = false window_size_x = 1280 window_size_y = 720 [Video] avpack = 8 custom_internal_display_resolution_x = 0 custom_internal_display_resolution_y = 0 enable_3d_mode = false interlaced = false [Vulkan] vulkan_allow_present_mode_fifo_relaxed = true vulkan_allow_present_mode_immediate = true vulkan_allow_present_mode_mailbox = true vulkan_device = -1 vulkan_log_debug_messages = true vulkan_pipeline_creation_threads = -1 vulkan_semaphore_reuse_workaround = false vulkan_sparse_shared_memory = true vulkan_validation = false [Win32] win32_high_resolution_timer = true win32_mmcss = true [x64] align_all_basic_blocks = 0 delay_via_maybeyield = false enable_host_guest_stack_synchronization = true enable_incorrect_roundingmode_behavior = false enable_rmw_context_merging = false instrument_call_times = false max_stackpoints = 65536 x64_extension_mask = -1 xop_arithmetic_right_shifts = false xop_compares = true xop_left_shifts = false xop_right_shifts = false xop_rotates = false ----------- END OF CONFIG DUMP ---- i> 000000D8 Loaded config: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\xenia-canary.config.toml i> 000000D8 Content root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\content i> 000000D8 Host cache root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\cache_host w> 000000D8 Unable to load Japanese font; JP characters will be boxes w> 000000D8 Unable to load Japanese font; JP characters will be boxes i> 00000128 Setup: Initializing Memory... i> 00000128 Setup: Initializing Exports... i> 00000128 Setup: Initializing Processor... i> 00000128 Setup: Initializing Audio... i> 00000128 Setup: Initializing Graphics... i> 00000128 Setup: Initializing HID... i> 00000128 winkey: "0x08" binds key 0x8 to controller input GUIDE. i> 00000128 winkey: "^A" binds key 0x41 to controller input DPAD_LEFT. i> 00000128 winkey: "^D" binds key 0x44 to controller input DPAD_RIGHT. i> 00000128 winkey: "^S" binds key 0x53 to controller input DPAD_DOWN. i> 00000128 winkey: "^W" binds key 0x57 to controller input DPAD_UP. i> 00000128 winkey: "_A" binds key 0x41 to controller input LEFT_THUMB_LEFT. i> 00000128 winkey: "_D" binds key 0x44 to controller input LEFT_THUMB_RIGHT. i> 00000128 winkey: "_S" binds key 0x53 to controller input LEFT_THUMB_DOWN. i> 00000128 winkey: "_W" binds key 0x57 to controller input LEFT_THUMB_UP. i> 00000128 winkey: "F" binds key 0x46 to controller input LEFT_THUMB_PRESSED. i> 00000128 winkey: "0x26" binds key 0x26 to controller input RIGHT_THUMB_UP. i> 00000128 winkey: "0x28" binds key 0x28 to controller input RIGHT_THUMB_DOWN. i> 00000128 winkey: "0x27" binds key 0x27 to controller input RIGHT_THUMB_RIGHT. i> 00000128 winkey: "0x25" binds key 0x25 to controller input RIGHT_THUMB_LEFT. i> 00000128 winkey: "K" binds key 0x4B to controller input RIGHT_THUMB_PRESSED. i> 00000128 winkey: "L" binds key 0x4C to controller input X. i> 00000128 winkey: "0xDE" binds key 0xDE to controller input B. i> 00000128 winkey: "0xBA" binds key 0xBA to controller input A. i> 00000128 winkey: "P" binds key 0x50 to controller input Y. i> 00000128 winkey: "Q" binds key 0x51 to controller input LEFT_TRIGGER. i> 00000128 winkey: "I" binds key 0x49 to controller input LEFT_TRIGGER. i> 00000128 winkey: "E" binds key 0x45 to controller input RIGHT_TRIGGER. i> 00000128 winkey: "O" binds key 0x4F to controller input RIGHT_TRIGGER. i> 00000128 winkey: "Z" binds key 0x5A to controller input BACK. i> 00000128 winkey: "X" binds key 0x58 to controller input START. i> 00000128 winkey: "1" binds key 0x31 to controller input LEFT_SHOULDER. i> 00000128 winkey: "3" binds key 0x33 to controller input RIGHT_SHOULDER. i> 000000D8 SDL Version 2.32.2 initialized. w> 000000D8 SDL GameControllerDB: file 'gamecontrollerdb.txt' does not exist. i> 00000128 Setup: Initializing VFS... i> 00000128 PatchDB: Loaded patches for 0 titles i> 00000128 Setup: Initializing Kernel... i> 00000128 ProfileManager: Found 0 Profiles w> 00000128 BaseHeap::AllocFixed attempting commit on unreserved page w> 00000128 BaseHeap::AllocFixed attempting commit on unreserved page K> 00000128 AUDIT-HLC XEvent::Set handle=F8000000 kevent_va=00000000 prio=1 lr=00000000 i> 00000128 Setup: Starting graphics_system... i> 00000128 DXGI adapter: NVIDIA GeForce GTX 1070 Ti (vendor 0x1002, device 0x73DF) i> 00000128 Direct3D 12 device and OS features: * Max GPU virtual address bits per resource: 40 * Non-zeroed heap creation: yes * Pixel-shader-specified stencil reference: no * Programmable sample positions: tier 0 * Rasterizer-ordered views: yes * Resource binding: tier 3 * Tiled resources: tier 4 * Unaligned block-compressed textures: yes i> 00000128 XThread01000010 (1) Stack: 70010000-70030000 i> 00000128 XThread01000014 (2) Stack: 70050000-70070000 i> 00000128 Setup: Starting audio_system... K> 01000010 XThread::Execute thid 1 (handle=01000010, 'GPU Commands (01000010)', native=00000158, ) K> 01000014 XThread::Execute thid 2 (handle=01000014, 'GPU Frame limiter (01000014)', native=0000015C, ) i> 00000128 XThread01000018 (3) Stack: 70090000-700B0000 i> 00000128 XThread0100001C (4) Stack: 700D0000-700F0000 K> 01000018 XThread::Execute thid 3 (handle=01000018, 'XMA Decoder (01000018)', native=00000160, ) K> 0100001C XThread::Execute thid 4 (handle=0100001C, 'Audio Worker (0100001C)', native=00000164, ) i> 000000D8 Checking for XISO F> 000000D8 DiscImageDevice::Initialize i> 000000D8 Checking for XISO F> 000000D8 DiscImageDevice::Initialize F> 000000D8 DiscImageDevice::Initialize i> 000000D8 Loading module GAME:\default.xex F> 000000D8 DiscImageDevice::ResolvePath(\default.xex) i> 000000D8 Module \Device\Cdrom0\default.xex: Module Hash: CCF935D24A74E002 Module Flags: 00000001 XEX_MODULE_TITLE Security Header: Image Flags: 00000008 XEX_IMAGE_XGD2_MEDIA_ONLY Load Address: 82000000 Image Size: 00920000 Export Table: 00000000 Optional Header Count: 15 XEX_HEADER_RESOURCE_INFO: 535107D4 828FB900-8291D8CF, 139215b XEX_HEADER_FILE_FORMAT_INFO: Info Size: 36 Encryption Type: Normal Compression Type: Normal Window Size: 32768 Block Size: 61440 Block Hash: B3 2B D7 D4 EF 96 9A C5 9F D7 77 C6 8A 99 AA 1C BD 87 1C BE 00 90 2E F1 46 3F A3 D7 00 00 00 10 XEX_HEADER_ENTRY_POINT: 824AB748 XEX_HEADER_IMAGE_BASE_ADDRESS: 82000000 XEX_HEADER_IMPORT_LIBRARIES: xam.xex - 104 imports Version: 2.0.4552.0 Min Version: 2.0.4552.0 xboxkrnl.exe - 294 imports Version: 2.0.4552.0 Min Version: 2.0.4552.0 XEX_HEADER_CHECKSUM_TIMESTAMP: Checksum : 00902EF1 Time Stamp: 463FA3D7 - Tue May 8 00:10:31 2007 XEX_HEADER_ORIGINAL_PE_NAME: default.pe XEX_HEADER_STATIC_LIBRARIES: XAPILIB : 2.0.3215.0 D3D9 : 2.0.3215.1 D3DX9 : 2.0.3215.0 XBOXKRNL : 2.0.3215.0 XAUD : 2.0.3215.0 LIBCPMT : 2.0.3215.0 XMP : 2.0.3215.0 XMEDIA : 2.0.3215.0 XONLINE : 2.0.3215.0 XGRAPHC : 2.0.3215.0 X3DAUD : 2.0.3215.1 XACT : 2.0.3215.1 XEX_HEADER_TLS_INFO: Slot Count: 64 Raw Data Address: 00000000 Data Size: 0 Raw Data Size: 0 XEX_HEADER_DEFAULT_STACK_SIZE: 524288 XEX_HEADER_SYSTEM_FLAGS: 00000400 XEX_SYSTEM_PAL50_INCOMPATIBLE XEX_HEADER_EXECUTION_INFO: Media ID: 2D2E2EEB Title ID: 535107D4 Savegame ID: 535107D4 Disc Number / Total: 1 / 1 XEX_HEADER_GAME_RATINGS: ESRB: Teen PEGI: 12+ PEGI-FI: 11+ PEGI - PT: 12+ BBFC: 12+ CERO: Unrated USK: Approved for children aged 12 and above OFLC - AU: Parental Guidance OFLC - NZ: Parental Guidance KMRB: Unrated Brazil: Unrated FPB: 13+ XEX_HEADER_LAN_KEY: E0 3C EA 47 3C AE 06 62 98 8F DB 7F 58 50 12 38 XEX_HEADER_XBOX360_LOGO: Section Size: 1736 Logo Size: 1728 Sections: 0 RODATA 1 pages 82000000 - 82010000 (65536 bytes) 1 RODATA 1 pages 82010000 - 82020000 (65536 bytes) 2 RODATA 1 pages 82020000 - 82030000 (65536 bytes) 3 RODATA 1 pages 82030000 - 82040000 (65536 bytes) 4 RODATA 1 pages 82040000 - 82050000 (65536 bytes) 5 RODATA 1 pages 82050000 - 82060000 (65536 bytes) 6 RODATA 1 pages 82060000 - 82070000 (65536 bytes) 7 RODATA 1 pages 82070000 - 82080000 (65536 bytes) 8 RODATA 1 pages 82080000 - 82090000 (65536 bytes) 9 RODATA 1 pages 82090000 - 820A0000 (65536 bytes) 10 RODATA 1 pages 820A0000 - 820B0000 (65536 bytes) 11 RODATA 1 pages 820B0000 - 820C0000 (65536 bytes) 12 RODATA 1 pages 820C0000 - 820D0000 (65536 bytes) 13 RODATA 1 pages 820D0000 - 820E0000 (65536 bytes) 14 RODATA 1 pages 820E0000 - 820F0000 (65536 bytes) 15 RODATA 1 pages 820F0000 - 82100000 (65536 bytes) 16 RODATA 1 pages 82100000 - 82110000 (65536 bytes) 17 RODATA 1 pages 82110000 - 82120000 (65536 bytes) 18 RODATA 1 pages 82120000 - 82130000 (65536 bytes) 19 RODATA 1 pages 82130000 - 82140000 (65536 bytes) 20 RODATA 1 pages 82140000 - 82150000 (65536 bytes) 21 CODE 1 pages 82150000 - 82160000 (65536 bytes) 22 CODE 1 pages 82160000 - 82170000 (65536 bytes) 23 CODE 1 pages 82170000 - 82180000 (65536 bytes) 24 CODE 1 pages 82180000 - 82190000 (65536 bytes) 25 CODE 1 pages 82190000 - 821A0000 (65536 bytes) 26 CODE 1 pages 821A0000 - 821B0000 (65536 bytes) 27 CODE 1 pages 821B0000 - 821C0000 (65536 bytes) 28 CODE 1 pages 821C0000 - 821D0000 (65536 bytes) 29 CODE 1 pages 821D0000 - 821E0000 (65536 bytes) 30 CODE 1 pages 821E0000 - 821F0000 (65536 bytes) 31 CODE 1 pages 821F0000 - 82200000 (65536 bytes) 32 CODE 1 pages 82200000 - 82210000 (65536 bytes) 33 CODE 1 pages 82210000 - 82220000 (65536 bytes) 34 CODE 1 pages 82220000 - 82230000 (65536 bytes) 35 CODE 1 pages 82230000 - 82240000 (65536 bytes) 36 CODE 1 pages 82240000 - 82250000 (65536 bytes) 37 CODE 1 pages 82250000 - 82260000 (65536 bytes) 38 CODE 1 pages 82260000 - 82270000 (65536 bytes) 39 CODE 1 pages 82270000 - 82280000 (65536 bytes) 40 CODE 1 pages 82280000 - 82290000 (65536 bytes) 41 CODE 1 pages 82290000 - 822A0000 (65536 bytes) 42 CODE 1 pages 822A0000 - 822B0000 (65536 bytes) 43 CODE 1 pages 822B0000 - 822C0000 (65536 bytes) 44 CODE 1 pages 822C0000 - 822D0000 (65536 bytes) 45 CODE 1 pages 822D0000 - 822E0000 (65536 bytes) 46 CODE 1 pages 822E0000 - 822F0000 (65536 bytes) 47 CODE 1 pages 822F0000 - 82300000 (65536 bytes) 48 CODE 1 pages 82300000 - 82310000 (65536 bytes) 49 CODE 1 pages 82310000 - 82320000 (65536 bytes) 50 CODE 1 pages 82320000 - 82330000 (65536 bytes) 51 CODE 1 pages 82330000 - 82340000 (65536 bytes) 52 CODE 1 pages 82340000 - 82350000 (65536 bytes) 53 CODE 1 pages 82350000 - 82360000 (65536 bytes) 54 CODE 1 pages 82360000 - 82370000 (65536 bytes) 55 CODE 1 pages 82370000 - 82380000 (65536 bytes) 56 CODE 1 pages 82380000 - 82390000 (65536 bytes) 57 CODE 1 pages 82390000 - 823A0000 (65536 bytes) 58 CODE 1 pages 823A0000 - 823B0000 (65536 bytes) 59 CODE 1 pages 823B0000 - 823C0000 (65536 bytes) 60 CODE 1 pages 823C0000 - 823D0000 (65536 bytes) 61 CODE 1 pages 823D0000 - 823E0000 (65536 bytes) 62 CODE 1 pages 823E0000 - 823F0000 (65536 bytes) 63 CODE 1 pages 823F0000 - 82400000 (65536 bytes) 64 CODE 1 pages 82400000 - 82410000 (65536 bytes) 65 CODE 1 pages 82410000 - 82420000 (65536 bytes) 66 CODE 1 pages 82420000 - 82430000 (65536 bytes) 67 CODE 1 pages 82430000 - 82440000 (65536 bytes) 68 CODE 1 pages 82440000 - 82450000 (65536 bytes) 69 CODE 1 pages 82450000 - 82460000 (65536 bytes) 70 CODE 1 pages 82460000 - 82470000 (65536 bytes) 71 CODE 1 pages 82470000 - 82480000 (65536 bytes) 72 CODE 1 pages 82480000 - 82490000 (65536 bytes) 73 CODE 1 pages 82490000 - 824A0000 (65536 bytes) 74 CODE 1 pages 824A0000 - 824B0000 (65536 bytes) 75 CODE 1 pages 824B0000 - 824C0000 (65536 bytes) 76 CODE 1 pages 824C0000 - 824D0000 (65536 bytes) 77 CODE 1 pages 824D0000 - 824E0000 (65536 bytes) 78 CODE 1 pages 824E0000 - 824F0000 (65536 bytes) 79 CODE 1 pages 824F0000 - 82500000 (65536 bytes) 80 CODE 1 pages 82500000 - 82510000 (65536 bytes) 81 CODE 1 pages 82510000 - 82520000 (65536 bytes) 82 CODE 1 pages 82520000 - 82530000 (65536 bytes) 83 CODE 1 pages 82530000 - 82540000 (65536 bytes) 84 CODE 1 pages 82540000 - 82550000 (65536 bytes) 85 CODE 1 pages 82550000 - 82560000 (65536 bytes) 86 CODE 1 pages 82560000 - 82570000 (65536 bytes) 87 CODE 1 pages 82570000 - 82580000 (65536 bytes) 88 CODE 1 pages 82580000 - 82590000 (65536 bytes) 89 CODE 1 pages 82590000 - 825A0000 (65536 bytes) 90 CODE 1 pages 825A0000 - 825B0000 (65536 bytes) 91 CODE 1 pages 825B0000 - 825C0000 (65536 bytes) 92 CODE 1 pages 825C0000 - 825D0000 (65536 bytes) 93 CODE 1 pages 825D0000 - 825E0000 (65536 bytes) 94 CODE 1 pages 825E0000 - 825F0000 (65536 bytes) 95 CODE 1 pages 825F0000 - 82600000 (65536 bytes) 96 CODE 1 pages 82600000 - 82610000 (65536 bytes) 97 CODE 1 pages 82610000 - 82620000 (65536 bytes) 98 CODE 1 pages 82620000 - 82630000 (65536 bytes) 99 CODE 1 pages 82630000 - 82640000 (65536 bytes) 100 CODE 1 pages 82640000 - 82650000 (65536 bytes) 101 CODE 1 pages 82650000 - 82660000 (65536 bytes) 102 CODE 1 pages 82660000 - 82670000 (65536 bytes) 103 CODE 1 pages 82670000 - 82680000 (65536 bytes) 104 CODE 1 pages 82680000 - 82690000 (65536 bytes) 105 CODE 1 pages 82690000 - 826A0000 (65536 bytes) 106 CODE 1 pages 826A0000 - 826B0000 (65536 bytes) 107 CODE 1 pages 826B0000 - 826C0000 (65536 bytes) 108 CODE 1 pages 826C0000 - 826D0000 (65536 bytes) 109 CODE 1 pages 826D0000 - 826E0000 (65536 bytes) 110 CODE 1 pages 826E0000 - 826F0000 (65536 bytes) 111 CODE 1 pages 826F0000 - 82700000 (65536 bytes) 112 CODE 1 pages 82700000 - 82710000 (65536 bytes) 113 CODE 1 pages 82710000 - 82720000 (65536 bytes) 114 CODE 1 pages 82720000 - 82730000 (65536 bytes) 115 CODE 1 pages 82730000 - 82740000 (65536 bytes) 116 CODE 1 pages 82740000 - 82750000 (65536 bytes) 117 CODE 1 pages 82750000 - 82760000 (65536 bytes) 118 CODE 1 pages 82760000 - 82770000 (65536 bytes) 119 CODE 1 pages 82770000 - 82780000 (65536 bytes) 120 CODE 1 pages 82780000 - 82790000 (65536 bytes) 121 CODE 1 pages 82790000 - 827A0000 (65536 bytes) 122 CODE 1 pages 827A0000 - 827B0000 (65536 bytes) 123 CODE 1 pages 827B0000 - 827C0000 (65536 bytes) 124 CODE 1 pages 827C0000 - 827D0000 (65536 bytes) 125 CODE 1 pages 827D0000 - 827E0000 (65536 bytes) 126 CODE 1 pages 827E0000 - 827F0000 (65536 bytes) 127 CODE 1 pages 827F0000 - 82800000 (65536 bytes) 128 CODE 1 pages 82800000 - 82810000 (65536 bytes) 129 CODE 1 pages 82810000 - 82820000 (65536 bytes) 130 CODE 1 pages 82820000 - 82830000 (65536 bytes) 131 CODE 1 pages 82830000 - 82840000 (65536 bytes) 132 CODE 1 pages 82840000 - 82850000 (65536 bytes) 133 CODE 1 pages 82850000 - 82860000 (65536 bytes) 134 CODE 1 pages 82860000 - 82870000 (65536 bytes) 135 RWDATA 1 pages 82870000 - 82880000 (65536 bytes) 136 RWDATA 1 pages 82880000 - 82890000 (65536 bytes) 137 RWDATA 1 pages 82890000 - 828A0000 (65536 bytes) 138 RWDATA 1 pages 828A0000 - 828B0000 (65536 bytes) 139 RWDATA 1 pages 828B0000 - 828C0000 (65536 bytes) 140 RWDATA 1 pages 828C0000 - 828D0000 (65536 bytes) 141 RWDATA 1 pages 828D0000 - 828E0000 (65536 bytes) 142 RWDATA 1 pages 828E0000 - 828F0000 (65536 bytes) 143 RWDATA 1 pages 828F0000 - 82900000 (65536 bytes) 144 RWDATA 1 pages 82900000 - 82910000 (65536 bytes) 145 RWDATA 1 pages 82910000 - 82920000 (65536 bytes) Imports: xam - 52 imports Version: 0.0.4552.32 Min Version: 0.0.4552.32 Total: 52 Known: 100% (52 known, 0 unknown) Implemented: 98% (51 implemented, 1 unimplemented) F 82000600 8284DA7C 28C ( 652) XNotifyPositionUI F 82000604 8284DA8C 2BC ( 700) XamShowSigninUI F 82000608 8284DA9C 2C1 ( 705) XamShowKeyboardUI F 8200060C 8284DAAC 2D5 ( 725) !! XamShowGamerCardUIForXUID F 82000610 8284DABC 2CB ( 715) XamShowDeviceSelectorUI F 82000614 8284DACC 2D9 ( 729) XamShowDirtyDiscErrorUI F 82000618 8284DADC 1B3 ( 435) XamTaskShouldExit F 8200061C 8284DAEC 1B1 ( 433) XamTaskCloseHandle F 82000620 8284DAFC 1AF ( 431) XamTaskSchedule F 82000624 8284DB0C 1A4 ( 420) XamLoaderLaunchTitle F 82000628 8284DB1C 1F7 ( 503) XMsgStartIORequest F 8200062C 8284DB2C 20E ( 526) XamUserGetName F 82000630 8284DB3C 210 ( 528) XamUserGetSigninState F 82000634 8284DB4C 282 ( 642) XamGetSystemVersion F 82000638 8284DB5C 2F7 ( 759) XamUserCreateStatsEnumerator F 8200063C 8284DB6C 2EE ( 750) XamUserCreateAchievementEnumerator F 82000640 8284DB7C 20A ( 522) XamUserGetXUID F 82000644 8284DB8C 250 ( 592) XamEnumerate F 82000648 8284DB9C 3CC ( 972) XGetGameRegion F 8200064C 8284DBAC 190 ( 400) XamInputGetCapabilities F 82000650 8284DBBC 191 ( 401) XamInputGetState F 82000654 8284DBCC 192 ( 402) XamInputSetState F 82000658 8284DBDC 198 ( 408) XamInputGetKeystrokeEx F 8200065C 8284DBEC 258 ( 600) XamContentCreate F 82000660 8284DBFC 25B ( 603) XamContentDelete F 82000664 8284DC0C 25A ( 602) XamContentClose F 82000668 8284DC1C 260 ( 608) XamContentSetThumbnail F 8200066C 8284DC2C 262 ( 610) XamContentGetCreator F 82000670 8284DC3C 25C ( 604) XamContentCreateEnumerator F 82000674 8284DC4C 265 ( 613) XamContentGetDeviceState F 82000678 8284DC5C 25E ( 606) XamContentGetDeviceData F 8200067C 8284DC6C 25F ( 607) XamContentGetDeviceName F 82000680 8284DC7C 1A0 ( 416) XamEnableInactivityProcessing F 82000684 8284DC8C 1A1 ( 417) XamResetInactivity F 82000688 8284DC9C 2DC ( 732) XamShowMessageBoxUIEx F 8200068C 8284DCAC 3CD ( 973) XGetLanguage F 82000690 8284DCBC 3CB ( 971) XGetAVPack F 82000694 8284DCCC 1A9 ( 425) XamLoaderTerminateTitle F 82000698 8284DCDC 280 ( 640) XamGetExecutionId F 8200069C 8284E45C 28B ( 651) XNotifyGetNext F 820006A0 8284E44C 002 ( 2) NetDll_WSACleanup F 820006A4 8284E43C 001 ( 1) NetDll_WSAStartup F 820006A8 8284E46C 28A ( 650) XamNotifyCreateListener F 820006AC 8284E42C 316 ( 790) XamSessionCreateHandle F 820006B0 8284E41C 317 ( 791) XamSessionRefObjByHandle F 820006B4 8284E40C 21A ( 538) XamUserWriteProfileSettings F 820006B8 8284E3FC 219 ( 537) XamUserReadProfileSettings F 820006BC 8284E3EC 1EA ( 490) XamAlloc F 820006C0 8284E3DC 1EC ( 492) XamFree F 820006C4 8284E3CC 3D1 ( 977) XGetVideoMode F 820006C8 8284E3BC 1F4 ( 500) XMsgInProcessCall F 820006CC 8284E3AC 1FC ( 508) XMsgStartIORequestEx xboxkrnl - 152 imports Version: 0.0.4552.32 Min Version: 0.0.4552.32 Total: 152 Known: 100% (152 known, 0 unknown) Implemented: 95% (145 implemented, 7 unimplemented) F 820006D4 8284E1FC 0B4 ( 180) KfReleaseSpinLock F 820006D8 8284E20C 0B1 ( 177) KfAcquireSpinLock F 820006DC 8284E21C 1DF ( 479) KiApcNormalRoutineNop F 820006E0 8284E22C 1B6 ( 438) VdEnableRingBufferRPtrWriteBack F 820006E4 8284E23C 1C3 ( 451) VdInitializeRingBuffer F 820006E8 8284E24C 0BE ( 190) MmGetPhysicalAddress F 820006EC 8284E25C 1D9 ( 473) VdSetSystemCommandBufferGpuIdentifierAddress F 820006F0 8284E26C 13B ( 315) sprintf F 820006F4 8284E27C 1B9 ( 441) VdGetCurrentDisplayGamma V 820006F8 266 ( 614) KeCertMonitorData F 820006FC 8284E28C 14D ( 333) _vsnprintf V 82000700 158 ( 344) XboxKrnlVersion F 82000704 8284E29C 1DC ( 476) VdShutdownEngines F 82000708 8284E2AC 1CA ( 458) VdQueryVideoMode F 8200070C 8284E2BC 1BA ( 442) VdGetCurrentDisplayInformation F 82000710 8284E2CC 1D3 ( 467) VdSetDisplayMode F 82000714 8284E2DC 1D5 ( 469) VdSetGraphicsInterruptCallback F 82000718 8284E2EC 1C2 ( 450) VdInitializeEngines F 8200071C 8284E2FC 1C6 ( 454) VdIsHSIOTrainingSucceeded F 82000720 8284E30C 1C9 ( 457) VdQueryVideoFlags F 82000724 8284E31C 1B1 ( 433) VdCallGraphicsNotificationRoutines V 82000728 1C0 ( 448) VdGpuClockInMHz F 8200072C 8284E32C 1C5 ( 453) VdInitializeScalerCommandBuffer F 82000730 8284E33C 269 ( 617) VdRetrainEDRAM F 82000734 8284E34C 26A ( 618) VdRetrainEDRAMWorker V 82000738 1C1 ( 449) VdHSIOCalibrationLock F 8200073C 8284E35C 06B ( 107) KeLockL2 F 82000740 8284E36C 06C ( 108) KeUnlockL2 F 82000744 8284E37C 1C7 ( 455) VdPersistDisplay F 82000748 8284E38C 25B ( 603) VdSwap F 8200074C 8284E39C 1BD ( 445) VdGetSystemCommandBuffer V 82000750 1BE ( 446) VdGlobalDevice F 82000754 8284E1EC 04D ( 77) KeAcquireSpinLockAtRaisedIrql F 82000758 8284E1DC 089 ( 137) KeReleaseSpinLockFromRaisedIrql F 8200075C 8284E1CC 1B4 ( 436) VdEnableDisableClockGating F 82000760 8284E1BC 13F ( 319) RtlTimeFieldsToTime F 82000764 8284E1AC 136 ( 310) RtlRaiseException F 82000768 8284E19C 0EE ( 238) NtQueryVirtualMemory F 8200076C 8284E18C 11B ( 283) RtlCompareMemoryUlong F 82000770 8284E17C 066 ( 102) KeGetCurrentProcessType F 82000774 8284E16C 053 ( 83) KeBugCheckEx F 82000778 8284E15C 126 ( 294) RtlFillMemoryUlong V 8200077C 1AE ( 430) ExLoadedCommandLine F 82000780 8284E14C 05A ( 90) KeDelayExecutionThread F 82000784 8284E13C 143 ( 323) RtlUnicodeToMultiByteN F 82000788 8284E12C 0E4 ( 228) NtQueryDirectoryFile F 8200078C 8284E10C 019 ( 25) ExTerminateThread F 82000790 8284E0FC 09B ( 155) KeSetCurrentStackPointers F 82000794 8284E0EC 197 ( 407) XexGetProcedureAddress F 82000798 8284E0DC 03C ( 60) !! IoDismountVolumeByFileHandle F 8200079C 8284E0CC 0D9 ( 217) NtDeviceIoControlFile F 820007A0 8284E0BC 028 ( 40) HalReturnToFirmware F 820007A4 8284E0AC 003 ( 3) DbgPrint F 820007A8 8284E09C 140 ( 320) RtlTimeToTimeFields F 820007AC 8284E08C 0FE ( 254) NtWaitForMultipleObjectsEx F 820007B0 8284E07C 0F3 ( 243) NtReleaseSemaphore F 820007B4 8284E06C 0D5 ( 213) NtCreateSemaphore F 820007B8 8284E05C 084 ( 132) KeQuerySystemTime F 820007BC 8284E04C 0E8 ( 232) NtQueryInformationFile F 820007C0 8284E03C 0F7 ( 247) NtSetInformationFile F 820007C4 8284E02C 0FD ( 253) NtWaitForSingleObjectEx F 820007C8 8284E01C 0CE ( 206) NtClearEvent F 820007CC 8284E00C 0F5 ( 245) NtResumeThread V 820007D0 0AD ( 173) KeTimeStampBundle F 820007D4 8284DFFC 010 ( 16) ExGetXConfigSetting V 820007D8 059 ( 89) KeDebugMonitorData F 820007DC 8284DFEC 097 ( 151) KeSetAffinityThread F 820007E0 8284DFDC 0FC ( 252) NtSuspendThread F 820007E4 8284DFCC 081 ( 129) KeQueryBasePriorityThread V 820007E8 01B ( 27) ExThreadObjectType F 820007EC 8284DFBC 110 ( 272) ObReferenceObjectByHandle F 820007F0 8284DFAC 099 ( 153) KeSetBasePriorityThread F 820007F4 8284DF9C 10B ( 267) ObLookupThreadByThreadId F 820007F8 8284DF8C 10E ( 270) ObOpenObjectByPointer F 820007FC 8284DF7C 0DA ( 218) NtDuplicateObject F 82000800 8284DF6C 101 ( 257) NtYieldExecution F 82000804 8284DF5C 0F6 ( 246) NtSetEvent F 82000808 8284DF4C 052 ( 82) KeBugCheck F 8200080C 8284DF3C 0BC ( 188) MmDeleteKernelStack F 82000810 8284DF2C 0BB ( 187) MmCreateKernelStack F 82000814 8284DF1C 0D1 ( 209) NtCreateEvent F 82000818 8284DF0C 135 ( 309) RtlNtStatusToDosError F 8200081C 8284DEFC 194 ( 404) XexCheckExecutablePrivilege F 82000820 8284DEEC 05F ( 95) KeEnterCriticalRegion F 82000824 8284DEDC 07D ( 125) KeLeaveCriticalRegion F 82000828 8284DECC 0CC ( 204) NtAllocateVirtualMemory F 8200082C 8284DEBC 259 ( 601) !! StfsCreateDevice F 82000830 8284DEAC 103 ( 259) ObCreateSymbolicLink F 82000834 8284DE9C 25A ( 602) !! StfsControlDevice F 82000838 8284DE8C 0DB ( 219) NtFlushBuffersFile F 8200083C 8284DE7C 104 ( 260) ObDeleteSymbolicLink F 82000840 8284DE6C 105 ( 261) ObDereferenceObject F 82000844 8284DE5C 0DC ( 220) NtFreeVirtualMemory F 82000848 8284DE4C 0D2 ( 210) NtCreateFile F 8200084C 8284DE3C 256 ( 598) XeKeysConsolePrivateKeySign F 82000850 8284DE2C 0F0 ( 240) NtReadFile F 82000854 8284DE1C 0FF ( 255) NtWriteFile F 82000858 8284DE0C 192 ( 402) XeCryptSha F 8200085C 8284DDFC 257 ( 599) !! XeKeysConsoleSignatureVerification F 82000860 8284DDEC 015 ( 21) ExRegisterTitleTerminateNotification F 82000864 8284DDDC 09D ( 157) KeSetEvent F 82000868 8284DDCC 0B0 ( 176) KeWaitForSingleObject F 8200086C 8284DDBC 08F ( 143) KeResetEvent V 82000870 193 ( 403) XexExecutableModuleHandle F 82000874 8284DDAC 12B ( 299) RtlImageXexHeaderField F 82000878 8284DD9C 1A5 ( 421) !! __C_specific_handler F 8200087C 8284DD8C 12C ( 300) RtlInitAnsiString F 82000880 8284DD7C 0DF ( 223) NtOpenFile F 82000884 8284DD6C 0CF ( 207) NtClose F 82000888 8284DD5C 0EF ( 239) NtQueryVolumeInformationFile F 8200088C 8284DD4C 0C4 ( 196) MmQueryAddressProtect F 82000890 8284DD3C 0BD ( 189) MmFreePhysicalMemory F 82000894 8284DD2C 0BA ( 186) MmAllocatePhysicalMemoryEx F 82000898 8284DD1C 12E ( 302) RtlInitializeCriticalSection F 8200089C 8284DD0C 130 ( 304) RtlLeaveCriticalSection F 820008A0 8284DCFC 125 ( 293) RtlEnterCriticalSection F 820008A4 8284DCEC 12F ( 303) RtlInitializeCriticalSectionAndSpinCount F 820008A8 8284E11C 00D ( 13) ExCreateThread F 820008AC 8284E47C 085 ( 133) KeRaiseIrqlToDpcLevel F 820008B0 8284E48C 0B3 ( 179) KfLowerIrql F 820008B4 8284E49C 088 ( 136) KeReleaseSemaphore F 820008B8 8284E4AC 1F8 ( 504) XAudioGetVoiceCategoryVolume F 820008BC 8284E4BC 1F7 ( 503) XAudioGetVoiceCategoryVolumeChangeMask F 820008C0 8284E4CC 0AF ( 175) KeWaitForMultipleObjects F 820008C4 8284E4DC 092 ( 146) KeResumeThread F 820008C8 8284E4EC 074 ( 116) KeInitializeSemaphore F 820008CC 8284E4FC 226 ( 550) XMAReleaseContext F 820008D0 8284E50C 224 ( 548) XMACreateContext F 820008D4 8284E51C 083 ( 131) KeQueryPerformanceFrequency F 820008D8 8284E52C 141 ( 321) RtlTryEnterCriticalSection F 820008DC 8284E53C 0AE ( 174) KeTryToAcquireSpinLockAtRaisedIrql F 820008E0 8284E54C 1F3 ( 499) XAudioRegisterRenderDriverClient F 820008E4 8284E55C 1F4 ( 500) XAudioUnregisterRenderDriverClient F 820008E8 8284E56C 1F5 ( 501) XAudioSubmitRenderDriverFrame F 820008EC 8284E57C 195 ( 405) XexGetModuleHandle F 820008F0 8284E58C 147 ( 327) !! RtlUnwind F 820008F4 8284E59C 152 ( 338) KeTlsAlloc F 820008F8 8284E5AC 154 ( 340) KeTlsGetValue F 820008FC 8284E5BC 155 ( 341) KeTlsSetValue F 82000900 8284E5CC 153 ( 339) KeTlsFree F 82000904 8284E5DC 119 ( 281) !! RtlCaptureContext F 82000908 8284E5EC 05D ( 93) KeEnableFpuExceptions F 8200090C 8284E5FC 0C6 ( 198) MmQueryStatistics F 82000910 8284E60C 0D7 ( 215) NtCreateTimer F 82000914 8284E61C 0FA ( 250) NtSetTimerEx F 82000918 8284E62C 0CD ( 205) NtCancelTimer F 8200091C 8284E63C 0E7 ( 231) NtQueryFullAttributesFile F 82000920 8284E64C 127 ( 295) RtlFreeAnsiString F 82000924 8284E65C 142 ( 322) RtlUnicodeStringToAnsiString F 82000928 8284E66C 12D ( 301) RtlInitUnicodeString F 8200092C 8284E67C 133 ( 307) RtlMultiByteToUnicodeN F 82000930 8284E68C 001 ( 1) DbgBreakPoint w> 000000D8 GameDatabase: Title doesn't contain XLAST data! Multiplayer functionality might be limited. i> 000000D8 Title name: PROJECT SYLPHEED i> 000000D8 -------------------- ACHIEVEMENTS -------------------- +----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ | ID | Title | Description | Type | Gamerscore | +----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ | 1 | Space Combat Award | Received after your first space battle in the Glasner Training Area. | Event | 20 | +----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ | 2 | Schlos Base Defense Award | Received for stopping the missile attack on Schlos Base. | Event | 20 | +----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ | 3 | Aegis of the People Medal | Received for escorting all 7 refugee ships to safety. | Event | 20 | +----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ | 4 | TCAF Luna Medal | Received for bravely helping the fleet escape during the invasion of the Matisse System. | Event | 20 | +----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ | 5 | TCAF Mars Medal | Received for bravery beyond the call of duty during the escape from the Matisse System. | Event | 40 | +----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ | 6 | Soldier's Charm Amulet | Given to you by Raymond as a token of his trust. | Event | 50 | +----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ | 7 | White Griffons Patch | Received by the commander and pilots of the White Griffon Squadron when it is formed. | Event | 20 | +----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ | 8 | TCAF Jupiter Medal | Received for bravery during the enemy's attack on the Alberti System. | Event | 30 | +----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ | 9 | Furious Pursuit Badge | Received for continuing attacks on the enemy and shooting down a large number of ships. | Event | 40 | +----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ | 10 | Solo Aerospace Combat Award | Received for descending into Acheron's atmosphere and engaging in combat alone. | Event | 30 | +----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ | 11 | Operation Nebula Blaze Award | Received for completing the extremely hazardous Operation Nebula Blaze. | Event | 30 | +----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ | 12 | Guilty Roses Patch | Received for repelling the Guilty Roses Squadron. | Event | 40 | +----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ | 13 | Super Battleship Slayer Patch | Received for shooting down the second S battleship. | Event | 30 | +----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ | 14 | TCAF Terra Medal | Received for shielding the fleet and seeing that all ships safely fled the Ingres System. | Event | 40 | +----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ | 15 | Hellfires Patch | Received for repelling the enemy Hellfire Squadron. | Event | 40 | +----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ | 16 | Night Ravens Patch | Received for challenging and eradicating the Night Raven Squadron. | Event | 50 | +----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ | 17 | Solar System Defense Award | Received for great achievements during the campaign to defend the Solar System. | Event | 40 | +----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ | 18 | Special Operations Medal | Received for heroically destroying the Prometheus Driver. | Event | 40 | +----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ | 19 | 1,000 Units Destroyed Medal | Received for shooting down 1,000 enemy fighters and attackers in combat. | Event | 30 | +----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ | 20 | 10,000 Units Destroyed Medal | Received for shooting down 10,000 enemy fighters and attackers in combat. | Event | 70 | +----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ | 21 | Ship Hunter Award | Received for shooting down 100 enemy warships in combat. | Event | 50 | +----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ | 22 | Gigaton Club Patch | Received for shooting down enemy vessels with a total weight of one gigaton. | Event | 70 | +----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ | 23 | Weapon Lord Patch | Received after you collect all usable equipment for the Delta Saber. | Event | 80 | +----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ | 24 | TCAF Pilot's Commendation | Commemmorates you as one of the greatest pilots in history. | Event | 100 | +----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ i> 000000D8 -------------------- PROPERTIES -------------------- +----------+------------------+-------------+-----------+ | ID | Name | Matchmaking | Data Size | +----------+------------------+-------------+-----------+ | 10000006 | Killed Aircrafts | False | 4 | +----------+------------------+-------------+-----------+ | 10000008 | Equipments | False | 4 | +----------+------------------+-------------+-----------+ | 1000000A | Clear Time | False | 4 | +----------+------------------+-------------+-----------+ | 1000000B | Killed Warships | False | 4 | +----------+------------------+-------------+-----------+ | 10008001 | Rank | False | 4 | +----------+------------------+-------------+-----------+ | 1000800A | | False | 4 | +----------+------------------+-------------+-----------+ | 1000800B | | False | 4 | +----------+------------------+-------------+-----------+ | 20000005 | Killed Weight | False | 8 | +----------+------------------+-------------+-----------+ | 20000007 | Clear Time | False | 8 | +----------+------------------+-------------+-----------+ | 20000009 | Earned Points | False | 8 | +----------+------------------+-------------+-----------+ | 40008002 | Gamer Name | False | 2 | +----------+------------------+-------------+-----------+ i> 000000D8 -------------------- CONTEXTS -------------------- +----------+-------------+-------------+---------------+-----------+ | ID | Name | Matchmaking | Default Value | Max Value | +----------+-------------+-------------+---------------+-----------+ | 00000000 | Game Stage | False | 0 | 28 | +----------+-------------+-------------+---------------+-----------+ | 00000001 | Game Status | False | 0 | 9 | +----------+-------------+-------------+---------------+-----------+ | 00008001 | | False | 0 | 0 | +----------+-------------+-------------+---------------+-----------+ | 0000800A | Game Type | True | 0 | 1 | +----------+-------------+-------------+---------------+-----------+ | 0000800B | | True | 0 | 0 | +----------+-------------+-------------+---------------+-----------+ i> 000000D8 -------------------- STATS VIEWS -------------------- +----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ | ID | View Type | Name | Skilled | Arbitrated | Hidden | Team View | Online Only | +----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ | 00000001 | Leaderboard | Time Attack (Permanent) | False | False | False | False | False | +----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ | 00000002 | Leaderboard | Score Attack (Permanent) | False | False | False | False | False | +----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ | 00000003 | Leaderboard | Extra 1 (Monthly) | False | False | False | False | False | +----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ | 00000004 | Leaderboard | Extra 1 (Permanent) | False | False | False | False | False | +----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ | 00000005 | Leaderboard | Extra 2 (Monthly) | False | False | False | False | False | +----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ | 00000006 | Leaderboard | Extra 2 (Permanent) | False | False | False | False | False | +----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ | 00000007 | Leaderboard | Extra 3 (Monthly) | False | False | False | False | False | +----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ | 00000008 | Leaderboard | Extra 3 (Permanent) | False | False | False | False | False | +----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ | 00000009 | Leaderboard | Extra 4 (Monthly) | False | False | False | False | False | +----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ | 0000000A | Leaderboard | Extra 4 (Permanent) | False | False | False | False | False | +----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ | 0000000C | Leaderboard | Time Attack (Monthly) | False | False | False | False | False | +----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ | 0000000D | Leaderboard | Score Attack (Monthly) | False | False | False | False | False | +----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ | FFFF0000 | Leaderboard | | True | False | False | False | False | +----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ i> 000000D8 -------------------- PRESENCE MODES -------------------- +---------------+----------------+------------------+ | Context Value | Contexts Count | Properties Count | +---------------+----------------+------------------+ | 0 | 2 | 0 | +---------------+----------------+------------------+ i> 000000D8 XThread01000020 (5) Stack: 70110000-70130000 i> 000000D8 KernelState: Launching module... i> 000000D8 XThreadF8000008 (6) Stack: 70150000-701D0000 K> 01000020 XThread::Execute thid 5 (handle=01000020, 'Kernel Dispatch (01000020)', native=00000194, ) K> F8000008 XThread::Execute thid 6 (handle=F8000008, 'Main XThread (F8000008)', native=00000198) K> F8000008 AUDIT-HLC XThread::Execute tid=6 start_address=824AB748 start_context=00000000 xapi=00000000 i> 01000010 Loaded 7 shaders from storage i> 01000010 Loaded 4 pipeline descriptions, 8 shader translations needed i> 01000010 Translated 7 shaders in 2 ms i> 01000010 Pipeline cache loaded: 4 created, 0 already exist, 4 total stored i> 01000010 Pipeline creation took 0 milliseconds K> F8000008 AUDIT-HLC NtCreateEvent handle=F800000C type=1 initial_state=0 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F800000C kevent_va=30029018 lr=824A9F6C F> F8000008 NullDevice::ResolvePath() F> F8000008 NullDevice::ResolvePath() F> F8000008 NullDevice::ResolvePath() !> F8000008 undefined extern call to 8284E0DC IoDismountVolumeByFileHandle F> F8000008 NullDevice::ResolvePath() i> F8000008 Got xam task args: v1 = 02080002, v2 = 00000000 i> F8000008 XThreadF8000010 (7) Stack: 701F0000-70270000 K> F8000010 XThread::Execute thid 7 (handle=F8000010, 'XThread01BC (F8000010)', native=000001BC) K> F8000010 AUDIT-HLC XThread::Execute tid=7 start_address=824A93C8 start_context=828A28F0 xapi=00000000 F> F8000010 NullDevice::ResolvePath() w> F8000010 Game is attempting to allocate devkit debug memory (base: 00000000, size: 000FF000). Ignoring debug flag and using normal allocation. !> F8000010 undefined extern call to 8284DEBC StfsCreateDevice K> F8000010 AUDIT-HLC KeSetEvent guest_ptr=8287094C lr=824A95D0 K> F8000010 AUDIT-HLC XEvent::Set handle=F8000014 kevent_va=00000000 prio=1 lr=824A95D0 K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000020 type=1 initial_state=0 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000020 kevent_va=3002F018 lr=824A9F6C K> F8000008 AUDIT-HLC ExCreateThread entry=82181830 start_ctx=828F3D08 xapi=824AFF88 flags=00000000 lr=824AC5F0 guest_lr=821817FC i> F8000008 XThreadF8000024 (8) Stack: 70290000-702B0000 K> F8000024 XThread::Execute thid 8 (handle=F8000024, 'XThread01C0 (F8000024)', native=000001C0) K> F8000024 AUDIT-HLC XThread::Execute tid=8 start_address=82181830 start_context=828F3D08 xapi=824AFF88 K> F8000024 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000020 alertable=0 lr=824AC578 guest_lr=824AFFC4 F> F8000008 HostPathDevice::ResolvePath() K> F8000008 AUDIT-HLC ExCreateThread entry=8245A5D0 start_ctx=828F4838 xapi=824AFF88 flags=00000000 lr=824AC5F0 guest_lr=824592B4 i> F8000008 XThreadF800002C (9) Stack: 702D0000-702E0000 K> F800002C XThread::Execute thid 9 (handle=F800002C, 'XThread01C4 (F800002C)', native=000001C4) K> F800002C AUDIT-HLC XThread::Execute tid=9 start_address=8245A5D0 start_context=828F4838 xapi=824AFF88 F> F800002C HostPathDevice::ResolvePath() F> F8000008 HostPathDevice::ResolvePath(\d4ea4615\e\46ee8ca) F> F800002C HostPathDevice::ResolvePath() F> F8000008 HostPathDevice::ResolvePath(\d4ea4615\e) K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000038 type=0 initial_state=0 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000038 kevent_va=3003B018 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent handle=F800003C type=0 initial_state=0 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F800003C kevent_va=3003D018 lr=824A9F6C K> F8000008 AUDIT-HLC ExCreateThread entry=82450A28 start_ctx=828F3B68 xapi=824AFF88 flags=00000000 lr=824AC5F0 guest_lr=82450034 i> F8000008 XThreadF8000044 (A) Stack: 70300000-70340000 K> F8000044 XThread::Execute thid 10 (handle=F8000044, 'XThread01C8 (F8000044)', native=000001C8) K> F8000044 AUDIT-HLC XThread::Execute tid=10 start_address=82450A28 start_context=828F3B68 xapi=824AFF88 K> F8000008 AUDIT-HLC NtDuplicateObject src=F8000038 dst=F8000048 options=00000002 lr=824AA3B4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=82452E64 K> F8000044 AUDIT-HLC NtCreateEvent handle=F800004C type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F800004C kevent_va=30045018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F800004C kevent_va=30045018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F800004C kevent_va=30045018 prio=0 lr=824AAFC8 !> F800002C BaseHeap::Release failed because address is not a region start !> F800002C PhysicalHeap::Release failed due to parent heap failure F> F800002C HostPathDevice::ResolvePath() F> F800002C HostPathDevice::ResolvePath() !> F8000044 BaseHeap::Release failed because address is not a region start !> F8000044 PhysicalHeap::Release failed due to parent heap failure K> F8000044 AUDIT-HLC NtSetEvent handle=F8000048 lr=824AA304 guest_lr=82450DF4 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000038 kevent_va=3003B018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=82452E64 !> F800002C BaseHeap::Release failed because address is not a region start !> F800002C PhysicalHeap::Release failed due to parent heap failure K> F800002C AUDIT-HLC NtWaitForSingleObjectEx handle=F8000028 alertable=0 lr=824AC578 guest_lr=824AFFC4 !> F8000008 BaseHeap::Release failed because address is not a region start !> F8000008 PhysicalHeap::Release failed due to parent heap failure !> F8000008 BaseHeap::Release failed because address is not a region start !> F8000008 PhysicalHeap::Release failed due to parent heap failure F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\8\3421153) F> F8000008 DiscImageDevice::ResolvePath(\dat) F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\355f2f8) F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000034 type=0 initial_state=0 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000034 kevent_va=3003B018 lr=824A9F6C K> F8000008 AUDIT-HLC NtDuplicateObject src=F8000034 dst=F8000038 options=00000002 lr=824AA3B4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000034 alertable=0 lr=824AC578 guest_lr=82452E64 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000048 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000048 kevent_va=30045018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000048 kevent_va=30045018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000048 kevent_va=30045018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000048 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000048 kevent_va=30045018 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent handle=F800004C type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F800004C kevent_va=30047018 lr=824A9F6C K> F8000044 AUDIT-HLC ExCreateThread entry=82457EF0 start_ctx=828F3B08 xapi=824AFF88 flags=00000000 lr=824AC5F0 guest_lr=82457EA0 i> F8000044 XThreadF8000054 (B) Stack: 70360000-70370000 K> F8000044 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000048 alertable=0 lr=824AC578 guest_lr=8245148C K> F8000054 XThread::Execute thid 11 (handle=F8000054, 'XThread01CC (F8000054)', native=000001CC) K> F8000054 AUDIT-HLC XThread::Execute tid=11 start_address=82457EF0 start_context=828F3B08 xapi=824AFF88 K> F8000054 AUDIT-HLC NtSetEvent handle=F8000048 lr=824AA304 guest_lr=82457F18 K> F8000054 AUDIT-HLC XEvent::Set handle=F8000048 kevent_va=30045018 prio=0 lr=824AA304 K> F8000044 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000048 result=00000000 lr=824AC578 guest_lr=8245148C !> F8000044 BaseHeap::Release failed because address is not a region start !> F8000044 PhysicalHeap::Release failed due to parent heap failure K> F8000044 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 guest_lr=82450DF4 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000034 kevent_va=3003B018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000034 result=00000000 lr=824AC578 guest_lr=82452E64 K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000034 type=1 initial_state=0 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000034 kevent_va=30045018 lr=824A9F6C K> F8000008 AUDIT-HLC ExCreateThread entry=824CD458 start_ctx=BE56BB3C xapi=00000000 flags=04000080 lr=824CD984 guest_lr=824C1AD8 i> F8000008 XThreadF8000048 (C) Stack: 70390000-703A0000 K> F8000048 XThread::Execute thid 12 (handle=F8000048, 'XThread01D0 (F8000048)', native=000001D0) K> F8000048 AUDIT-HLC XThread::Execute tid=12 start_address=824CD458 start_context=BE56BB3C xapi=00000000 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC singleton[0x828E1F08]=BC22C910 vtable=820A183C vtable[0]=82175330 vtable[24]=82175378 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 i> F8000008 Hardware scaler: width ratio 1:1, height ratio 1:1, final aspect ratio 16:9 i> 01000010 Selecting rep movs vastcpy. K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> F8000008 AUDIT-HLC NtCreateEvent handle=F800005C type=1 initial_state=0 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F800005C kevent_va=30053018 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000060 type=1 initial_state=0 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000060 kevent_va=30055018 lr=824A9F6C K> F8000008 AUDIT-HLC ExCreateThread entry=822F1EE0 start_ctx=BCE24A40 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=822F1B0C i> F8000008 XThreadF8000064 (D) Stack: 703C0000-70440000 K> F8000064 XThread::Execute thid 13 (handle=F8000064, 'XThread01D4 (F8000064)', native=000001D4) K> F8000064 AUDIT-HLC XThread::Execute tid=13 start_address=822F1EE0 start_context=BCE24A40 xapi=824AFF88 F> F8000008 HostPathDevice::ResolvePath(\aab216c3\a\2c8c185) F> F8000008 HostPathDevice::ResolvePath(\aab216c3\a) K> F8000008 AUDIT-HLC NtCreateEvent handle=F800006C type=0 initial_state=0 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F800006C kevent_va=3005B018 lr=824A9F6C K> F8000008 AUDIT-HLC NtDuplicateObject src=F800006C dst=F8000070 options=00000002 lr=824AA3B4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800006C alertable=0 lr=824AC578 guest_lr=82452E64 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000074 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000074 kevent_va=3005D018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000074 kevent_va=3005D018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=3005D018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000074 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000074 kevent_va=3005D018 lr=824A9F6C K> F8000044 AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=8245802C K> F8000044 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000074 alertable=0 lr=824AC578 guest_lr=8245148C K> F8000054 AUDIT-HLC NtSetEvent handle=F8000074 lr=824AA304 guest_lr=82457F18 K> F8000054 AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=3005D018 prio=0 lr=824AA304 K> F8000044 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000074 result=00000000 lr=824AC578 guest_lr=8245148C !> F8000044 BaseHeap::Release failed because address is not a region start !> F8000044 PhysicalHeap::Release failed due to parent heap failure K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> F8000044 AUDIT-HLC NtSetEvent handle=F8000070 lr=824AA304 guest_lr=82450DF4 K> F8000044 AUDIT-HLC XEvent::Set handle=F800006C kevent_va=3005B018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800006C result=00000000 lr=824AC578 guest_lr=82452E64 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\73a5c0a) F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) K> F8000008 AUDIT-HLC NtCreateEvent handle=F800006C type=0 initial_state=0 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F800006C kevent_va=3005B018 lr=824A9F6C K> F8000008 AUDIT-HLC NtDuplicateObject src=F800006C dst=F8000070 options=00000002 lr=824AA3B4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800006C alertable=0 lr=824AC578 guest_lr=82452E64 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000074 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000074 kevent_va=3005D018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000074 kevent_va=3005D018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=3005D018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000074 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000074 kevent_va=3005D018 lr=824A9F6C K> F8000044 AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=8245802C K> F8000044 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000074 alertable=0 lr=824AC578 guest_lr=8245148C K> F8000054 AUDIT-HLC NtSetEvent handle=F8000074 lr=824AA304 guest_lr=82457F18 K> F8000054 AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=3005D018 prio=0 lr=824AA304 K> F8000044 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000074 result=00000000 lr=824AC578 guest_lr=8245148C K> F8000044 AUDIT-HLC NtSetEvent handle=F8000070 lr=824AA304 guest_lr=82450DF4 K> F8000044 AUDIT-HLC XEvent::Set handle=F800006C kevent_va=3005B018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800006C result=00000000 lr=824AC578 guest_lr=82452E64 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC ExCreateThread entry=824D2878 start_ctx=00000000 xapi=00000000 flags=10000001 lr=824D2E68 guest_lr=824D059C i> F8000008 XThreadF800006C (E) Stack: 70460000-704E0000 K> F8000008 AUDIT-HLC ExCreateThread entry=824D2940 start_ctx=00000000 xapi=00000000 flags=20000001 lr=824D2E68 guest_lr=824D059C i> F8000008 XThreadF8000070 (F) Stack: 70500000-70580000 K> F800006C XThread::Execute thid 14 (handle=F800006C, 'XThread01D8 (F800006C)', native=000001D8) K> F800006C AUDIT-HLC XThread::Execute tid=14 start_address=824D2878 start_context=00000000 xapi=00000000 K> F8000070 XThread::Execute thid 15 (handle=F8000070, 'XThread01DC (F8000070)', native=000001DC) K> F8000070 AUDIT-HLC XThread::Execute tid=15 start_address=824D2940 start_context=00000000 xapi=00000000 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 i> F8000008 AudioSystem::RegisterClient: driver created for index=0, driver=0x787c44e61c90 i> F8000008 AudioSystem::RegisterClient: client 0 registered successfully K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000084 type=0 initial_state=0 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000084 kevent_va=30064018 lr=824A9F6C F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\39a9dcc) F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000084 alertable=0 lr=824AC578 guest_lr=8245FA10 K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30066018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F800008C kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=30066018 prio=0 lr=824AAFC8 !> F8000044 BaseHeap::Release failed because address is not a region start !> F8000044 PhysicalHeap::Release failed due to parent heap failure K> F8000044 AUDIT-HLC NtDuplicateObject src=F8000084 dst=F800008C options=00000002 lr=824AA3B4 K> F8000044 AUDIT-HLC NtSetEvent handle=F800008C lr=824AA304 guest_lr=82460EC0 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000084 kevent_va=30064018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000084 result=00000000 lr=824AC578 guest_lr=8245FA10 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000084 type=0 initial_state=0 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000084 kevent_va=30064018 lr=824A9F6C F> F8000008 DiscImageDevice::ResolvePath(\dat) K> F8000008 AUDIT-HLC NtDuplicateObject src=F8000084 dst=F800008C options=00000002 lr=824AA3B4 K> F8000008 AUDIT-HLC NtSetEvent handle=F800008C lr=824AA304 guest_lr=82460078 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000084 kevent_va=30064018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000084 alertable=0 lr=824AC578 guest_lr=82460150 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000084 result=00000000 lr=824AC578 guest_lr=82460150 K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000084 type=0 initial_state=0 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000084 kevent_va=30064018 lr=824A9F6C K> F8000008 AUDIT-HLC NtDuplicateObject src=F8000084 dst=F800008C options=00000002 lr=824AA3B4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000084 alertable=0 lr=824AC578 guest_lr=82179148 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000090 kevent_va=30066018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000090 kevent_va=30066018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000090 kevent_va=30066018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtSetEvent handle=F800008C lr=824AA304 guest_lr=82450DF4 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000084 kevent_va=30064018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000084 result=00000000 lr=824AC578 guest_lr=82179148 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC ExCreateThread entry=82178950 start_ctx=828F3EC0 xapi=824AFF88 flags=00000000 lr=824AC5F0 guest_lr=82178F08 i> F8000008 XThreadF8000084 (10) Stack: 705A0000-705B0000 K> F8000084 XThread::Execute thid 16 (handle=F8000084, 'XThread01F0 (F8000084)', native=000001F0) K> F8000084 AUDIT-HLC XThread::Execute tid=16 start_address=82178950 start_context=828F3EC0 xapi=824AFF88 K> F8000008 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30068018 lr=824A9F6C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800008C alertable=0 lr=824AC578 guest_lr=82173BD4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000064 AUDIT-HLC NtSetEvent handle=F800008C lr=824AA304 guest_lr=822F1FC8 K> F8000064 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=30068018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800008C result=00000000 lr=824AC578 guest_lr=82173BD4 K> F8000064 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000034 alertable=0 lr=824AC578 guest_lr=822F1FC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000034 lr=824AA304 guest_lr=82173BF0 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000034 kevent_va=30045018 prio=0 lr=824AA304 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000064 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000034 result=00000000 lr=824AC578 guest_lr=822F1FC8 K> F8000008 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30068018 lr=824A9F6C K> F8000008 AUDIT-HLC ExCreateThread entry=821748F0 start_ctx=BC365700 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=82174828 i> F8000008 XThreadF8000090 (11) Stack: 705D0000-70650000 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000090 alertable=0 lr=824AC578 guest_lr=822F1B50 K> F8000090 XThread::Execute thid 17 (handle=F8000090, 'XThread01F4 (F8000090)', native=000001F4) K> F8000090 AUDIT-HLC XThread::Execute tid=17 start_address=821748F0 start_context=BC365700 xapi=824AFF88 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000090 AUDIT-HLC NtCreateEvent handle=F8000094 type=1 initial_state=1 lr=824A9F6C K> F8000090 AUDIT-HLC NtCreateEvent_inner handle=F8000094 kevent_va=3006E018 lr=824A9F6C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000090 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C K> F8000090 AUDIT-HLC NtCreateEvent_inner handle=F8000098 kevent_va=30070018 lr=824A9F6C F> F8000090 HostPathDevice::ResolvePath(\aab216c3\5\ee70e0a) F> F8000090 HostPathDevice::ResolvePath(\aab216c3\5) K> F8000090 AUDIT-HLC NtDuplicateObject src=F8000098 dst=F80000A0 options=00000002 lr=824AA3B4 K> F8000090 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000098 alertable=0 lr=824AC578 guest_lr=821CBAE0 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A4 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000A4 kevent_va=30072018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000A4 kevent_va=30072018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000A4 kevent_va=30072018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A4 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000A4 kevent_va=30072018 lr=824A9F6C K> F8000044 AUDIT-HLC XEvent::Set handle=F8000078 kevent_va=00000000 prio=1 lr=8245802C K> F8000044 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A4 alertable=0 lr=824AC578 guest_lr=8245148C K> F8000054 AUDIT-HLC NtSetEvent handle=F80000A4 lr=824AA304 guest_lr=82457F18 K> F8000054 AUDIT-HLC XEvent::Set handle=F80000A4 kevent_va=30072018 prio=0 lr=824AA304 K> F8000044 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000A4 result=00000000 lr=824AC578 guest_lr=8245148C K> F8000044 AUDIT-HLC NtSetEvent handle=F80000A0 lr=824AA304 guest_lr=82450DF4 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000098 kevent_va=30070018 prio=0 lr=824AA304 K> F8000090 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000098 result=00000000 lr=824AC578 guest_lr=821CBAE0 K> F8000090 AUDIT-HLC ExCreateThread entry=821C4AD0 start_ctx=BCA44C00 xapi=824AFF88 flags=00000000 lr=824AC5F0 guest_lr=821C4F64 i> F8000090 XThreadF8000098 (12) Stack: 70670000-70680000 K> F8000098 XThread::Execute thid 18 (handle=F8000098, 'XThread01F8 (F8000098)', native=000001F8) K> F8000098 AUDIT-HLC XThread::Execute tid=18 start_address=821C4AD0 start_context=BCA44C00 xapi=824AFF88 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000098 AUDIT-HLC ExCreateThread entry=822C6870 start_ctx=828F3300 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=822C66F4 i> F8000098 XThreadF80000A0 (13) Stack: 706A0000-706D0000 K> F8000098 AUDIT-HLC ExCreateThread entry=822C6870 start_ctx=828F3300 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=822C66F4 i> F8000098 XThreadF80000A4 (14) Stack: 706F0000-70720000 K> F80000A0 XThread::Execute thid 19 (handle=F80000A0, 'XThread01FC (F80000A0)', native=000001FC) K> F80000A0 AUDIT-HLC XThread::Execute tid=19 start_address=822C6870 start_context=828F3300 xapi=824AFF88 K> F80000A4 XThread::Execute thid 20 (handle=F80000A4, 'XThread0200 (F80000A4)', native=00000200) K> F80000A4 AUDIT-HLC XThread::Execute tid=20 start_address=822C6870 start_context=828F3300 xapi=824AFF88 K> F80000A4 AUDIT-HLC NtWaitForSingleObjectEx handle=F800009C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F800009C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000090 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C K> F8000090 AUDIT-HLC NtCreateEvent_inner handle=F80000A8 kevent_va=3007E018 lr=824A9F6C F> F8000090 HostPathDevice::ResolvePath(\87719002\c\dba806e) F> F8000090 HostPathDevice::ResolvePath(\87719002\c) K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000090 AUDIT-HLC NtDuplicateObject src=F80000A8 dst=F80000B0 options=00000002 lr=824AA3B4 K> F8000090 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C K> F8000090 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=30080018 lr=824A9F6C F> F8000090 HostPathDevice::ResolvePath(\87719002\c\ec0a96e) F> F8000090 HostPathDevice::ResolvePath(\87719002\c) K> F8000090 AUDIT-HLC NtDuplicateObject src=F80000B4 dst=F80000BC options=00000002 lr=824AA3B4 F> F8000098 DiscImageDevice::ResolvePath(\hidden\Resource3D) K> F8000090 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C K> F8000090 AUDIT-HLC NtCreateEvent_inner handle=F80000C4 kevent_va=30082018 lr=824A9F6C F> F8000090 HostPathDevice::ResolvePath(\87719002\a\60fcb85) K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000C8 type=1 initial_state=0 lr=824A9F6C K> F8000098 AUDIT-HLC NtCreateEvent_inner handle=F80000C8 kevent_va=30084018 lr=824A9F6C F> F8000090 HostPathDevice::ResolvePath(\87719002\a) K> F8000090 AUDIT-HLC NtDuplicateObject src=F80000C4 dst=F80000D0 options=00000002 lr=824AA3B4 K> F8000090 AUDIT-HLC NtCreateEvent handle=F80000D4 type=0 initial_state=0 lr=824A9F6C K> F8000090 AUDIT-HLC NtCreateEvent_inner handle=F80000D4 kevent_va=30086018 lr=824A9F6C K> F8000098 AUDIT-HLC NtDuplicateObject src=F80000C8 dst=F80000D8 options=00000002 lr=824AA3B4 K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C8 alertable=0 lr=824AC578 guest_lr=822DFCC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 F> F8000090 HostPathDevice::ResolvePath(\87719002\2\85d8849) K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C F> F8000090 HostPathDevice::ResolvePath(\87719002\2) K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000090 AUDIT-HLC NtDuplicateObject src=F80000D4 dst=F80000E0 options=00000002 lr=824AA3B4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000090 AUDIT-HLC NtCreateEvent handle=F80000E4 type=0 initial_state=0 lr=824A9F6C K> F8000090 AUDIT-HLC NtCreateEvent_inner handle=F80000E4 kevent_va=30088018 lr=824A9F6C F> F8000090 HostPathDevice::ResolvePath(\87719002\a\715f485) F> F8000090 HostPathDevice::ResolvePath(\87719002\a) K> F8000090 AUDIT-HLC NtDuplicateObject src=F80000E4 dst=F80000EC options=00000002 lr=824AA3B4 K> F8000090 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C K> F8000090 AUDIT-HLC NtCreateEvent_inner handle=F80000F0 kevent_va=3008A018 lr=824A9F6C F> F8000090 HostPathDevice::ResolvePath(\87719002\c\f2a8ccd) F> F8000090 HostPathDevice::ResolvePath(\87719002\c) K> F8000090 AUDIT-HLC NtDuplicateObject src=F80000F0 dst=F80000F8 options=00000002 lr=824AA3B4 K> F8000090 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C K> F8000090 AUDIT-HLC NtCreateEvent_inner handle=F80000FC kevent_va=3008C018 lr=824A9F6C F> F8000090 HostPathDevice::ResolvePath(\87719002\0\1a2db9c) F> F8000090 HostPathDevice::ResolvePath(\87719002\0) K> F8000090 AUDIT-HLC NtDuplicateObject src=F80000FC dst=F8000104 options=00000002 lr=824AA3B4 K> F8000090 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C515C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000108 kevent_va=3008E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000108 kevent_va=3008E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000108 kevent_va=3008E018 prio=0 lr=824AAFC8 !> F8000044 BaseHeap::Release failed because address is not a region start !> F8000044 PhysicalHeap::Release failed due to parent heap failure K> F8000044 AUDIT-HLC NtSetEvent handle=F80000B0 lr=824AA304 guest_lr=82450DF4 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000A8 kevent_va=3007E018 prio=0 lr=824AA304 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3008E018 lr=824A9F6C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3008E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3008E018 prio=0 lr=824AAFC8 !> F8000044 BaseHeap::Release failed because address is not a region start !> F8000044 PhysicalHeap::Release failed due to parent heap failure K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3008E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3008E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3008E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtSetEvent handle=F80000BC lr=824AA304 guest_lr=82450DF4 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=30080018 prio=0 lr=824AA304 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3008E018 lr=824A9F6C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3008E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3008E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3008E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3008E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3008E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3008E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3008E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3008E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3008E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3008E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3008E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3008E018 lr=824A9F6C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3008E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3008E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3008E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3008E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3008E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3008E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3008E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3008E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3008E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3008E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3008E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3008E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3008E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3008E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3008E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3008E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3008E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3008E018 lr=824A9F6C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3008E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3008E018 prio=0 lr=824AAFC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3008E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3008E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3008E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3008E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3008E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3008E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3008E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3008E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3008E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3008E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3008E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3008E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3008E018 lr=824A9F6C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3008E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3008E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3008E018 lr=824A9F6C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3008E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3008E018 prio=0 lr=824AAFC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3008E018 lr=824A9F6C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3008E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3008E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3008E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3008E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3008E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3008E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3008E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3008E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3008E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3008E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3008E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtSetEvent handle=F80000D0 lr=824AA304 guest_lr=82450DF4 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C4 kevent_va=30082018 prio=0 lr=824AA304 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3008E018 lr=824A9F6C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3008E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3008E018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000044 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 guest_lr=82450DF4 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C8 kevent_va=30084018 prio=0 lr=824AA304 K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C8 result=00000000 lr=824AC578 guest_lr=822DFCC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000098 AUDIT-HLC NtDuplicateObject src=F80000C8 dst=F80000AC options=00000002 lr=824AA3B4 K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C8 alertable=0 lr=824AC578 guest_lr=822DFE24 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3008E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=3008E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3008E018 prio=0 lr=824AAFC8 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 !> F8000044 BaseHeap::Release failed because address is not a region start !> F8000044 PhysicalHeap::Release failed due to parent heap failure K> F8000044 AUDIT-HLC NtSetEvent handle=F80000E0 lr=824AA304 guest_lr=82450DF4 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000D4 kevent_va=30086018 prio=0 lr=824AA304 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3008E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=3008E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3008E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3008E018 lr=824A9F6C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=3008E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3008E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3008E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=3008E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3008E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3008E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=3008E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3008E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3008E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=3008E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3008E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3008E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=3008E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3008E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3008E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=3008E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3008E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3008E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=3008E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3008E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3008E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=3008E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3008E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3008E018 lr=824A9F6C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=3008E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3008E018 prio=0 lr=824AAFC8 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3008E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=3008E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=3008E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtSetEvent handle=F80000EC lr=824AA304 guest_lr=82450DF4 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000E4 kevent_va=30088018 prio=0 lr=824AA304 K> F8000090 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C515C K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=30088018 lr=824A9F6C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000090 result=00000000 lr=824AC578 guest_lr=822F1B50 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=30088018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=30088018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtSetEvent handle=F80000F8 lr=824AA304 guest_lr=82450DF4 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000F0 kevent_va=3008A018 prio=0 lr=824AA304 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=30088018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000B0 kevent_va=30088018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000B0 kevent_va=30088018 prio=0 lr=824AAFC8 !> F8000044 BaseHeap::Release failed because address is not a region start !> F8000044 PhysicalHeap::Release failed due to parent heap failure K> F8000044 AUDIT-HLC NtSetEvent handle=F8000104 lr=824AA304 guest_lr=82450DF4 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000FC kevent_va=3008C018 prio=0 lr=824AA304 K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30068018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F800008C kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=30068018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30068018 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F80000B0 kevent_va=3006A018 lr=824A9F6C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F800008C kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30068018 lr=824A9F6C K> F8000008 AUDIT-HLC ExCreateThread entry=824563E0 start_ctx=828F3E70 xapi=824AFF88 flags=00000000 lr=824AC5F0 guest_lr=82456A44 i> F8000008 XThreadF80000B8 (15) Stack: 705D0000-705E0000 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000BC alertable=0 lr=824AC578 guest_lr=8216EE14 K> F80000B8 XThread::Execute thid 21 (handle=F80000B8, 'XThread0204 (F80000B8)', native=00000204) K> F80000B8 AUDIT-HLC XThread::Execute tid=21 start_address=824563E0 start_context=828F3E70 xapi=824AFF88 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F800008C kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30068018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F800008C kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30068018 lr=824A9F6C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000BC result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F800008C kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30068018 lr=824A9F6C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F800008C kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=30068018 prio=0 lr=824AAFC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30068018 lr=824A9F6C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F800008C kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30068018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F800008C kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000022 r5=828F3888 r6=701CF924 r7=82456F00 r8=00000000 r9=00000000 r10=00000022 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00010004 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 BC365BC0 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000000 00000000 00000000 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30068018 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000CC type=1 initial_state=0 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F80000CC kevent_va=30090018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F800008C kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30068018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F800008C kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30068018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F800008C kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30068018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F800008C kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30068018 lr=824A9F6C K> F8000008 AUDIT-HLC ExCreateThread entry=82170430 start_ctx=828F4070 xapi=824AFF88 flags=00000000 lr=824AC5F0 guest_lr=82170260 i> F8000008 XThreadF80000D0 (16) Stack: 70600000-70610000 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F800008C kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30068018 lr=824A9F6C K> F80000D0 XThread::Execute thid 22 (handle=F80000D0, 'XThread0208 (F80000D0)', native=00000208) K> F80000D0 AUDIT-HLC XThread::Execute tid=22 start_address=82170430 start_context=828F4070 xapi=824AFF88 K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F80000D8 kevent_va=30096018 lr=824A9F6C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D8 alertable=0 lr=824AC578 guest_lr=82172BC8 K> F8000064 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 guest_lr=822F1FC8 K> F8000064 AUDIT-HLC XEvent::Set handle=F80000D8 kevent_va=30096018 prio=0 lr=824AA304 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F800008C kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D8 result=00000000 lr=824AC578 guest_lr=82172BC8 K> F8000064 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000034 alertable=0 lr=824AC578 guest_lr=822F1FC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000044 AUDIT-HLC NtSetEvent handle=F80000AC lr=824AA304 guest_lr=82450DF4 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C8 kevent_va=30084018 prio=0 lr=824AA304 K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C8 result=00000000 lr=824AC578 guest_lr=822DFE24 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F80000D0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000CC alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000098 AUDIT-HLC NtDuplicateObject src=F80000C8 dst=F800008C options=00000002 lr=824AA3B4 K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C8 alertable=0 lr=824AC578 guest_lr=822DFED0 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F80000D8 kevent_va=30096018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F80000E0 kevent_va=3009A018 lr=824A9F6C K> F8000008 AUDIT-HLC ExCreateThread entry=823DDE30 start_ctx=828F3C4C xapi=824AFF88 flags=00000000 lr=824AC5F0 guest_lr=823DDDB4 i> F8000008 XThreadF80000E8 (17) Stack: 70630000-70640000 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F80000E8 XThread::Execute thid 23 (handle=F80000E8, 'XThread020C (F80000E8)', native=0000020C) K> F80000E8 AUDIT-HLC XThread::Execute tid=23 start_address=823DDE30 start_context=828F3C4C xapi=824AFF88 K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F80000EC kevent_va=300A2018 lr=824A9F6C K> F8000008 AUDIT-HLC ExCreateThread entry=823DDB50 start_ctx=828F3C88 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=823DD924 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 i> F8000008 XThreadF80000F8 (18) Stack: 70740000-707C0000 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C K> F8000008 AUDIT-HLC ExCreateThread entry=823DDB50 start_ctx=828F3C88 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=823DD924 i> F8000008 XThreadF8000104 (19) Stack: 707E0000-70860000 K> F80000F8 XThread::Execute thid 24 (handle=F80000F8, 'XThread0210 (F80000F8)', native=00000210) K> F80000F8 AUDIT-HLC XThread::Execute tid=24 start_address=823DDB50 start_context=828F3C88 xapi=824AFF88 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C K> F8000104 XThread::Execute thid 25 (handle=F8000104, 'XThread0214 (F8000104)', native=00000214) K> F8000104 AUDIT-HLC XThread::Execute tid=25 start_address=823DDB50 start_context=828F3C88 xapi=824AFF88 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C K> F8000008 AUDIT-HLC NtSetEvent handle=F8000034 lr=824AA304 guest_lr=82172DF4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000034 kevent_va=30045018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000064 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000034 result=00000000 lr=824AC578 guest_lr=822F1FC8 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000003 r5=828F3888 r6=701CF924 r7=BC22CA60 r8=00000001 r9=00000000 r10=00000026 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30068018 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F80000A8 kevent_va=3007E018 lr=824A9F6C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A8 alertable=0 lr=824AC578 guest_lr=821CC19C K> F8000064 AUDIT-HLC NtSetEvent handle=F80000A8 lr=824AA304 guest_lr=822F1FC8 K> F8000064 AUDIT-HLC XEvent::Set handle=F80000A8 kevent_va=3007E018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000A8 result=00000000 lr=824AC578 guest_lr=821CC19C K> F8000064 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000034 alertable=0 lr=824AC578 guest_lr=822F1FC8 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000A8 kevent_va=30068018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000A8 kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000A8 kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000A8 kevent_va=30068018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000A8 kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000A8 kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000A8 kevent_va=30068018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000A8 kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000A8 kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000A8 kevent_va=30068018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000A8 kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000A8 kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000A8 kevent_va=30068018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000A8 kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000A8 kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000A8 kevent_va=30068018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000A8 kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000A8 kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000A8 kevent_va=30068018 lr=824A9F6C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000A8 kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000A8 kevent_va=30068018 prio=0 lr=824AAFC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000A8 kevent_va=30068018 lr=824A9F6C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000A8 kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000A8 kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000A8 kevent_va=30068018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000A8 kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000A8 kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000A8 kevent_va=30068018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000A8 kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000A8 kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000A8 kevent_va=30068018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000A8 kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000A8 kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000A8 kevent_va=30068018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000A8 kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000A8 kevent_va=30068018 prio=0 lr=824AAFC8 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000A8 kevent_va=30068018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000A8 kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000A8 kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000A8 kevent_va=30068018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000A8 kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000A8 kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000A8 kevent_va=30068018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000A8 kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000A8 kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000A8 kevent_va=30068018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000A8 kevent_va=30068018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000A8 kevent_va=30068018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtSetEvent handle=F800008C lr=824AA304 guest_lr=82450DF4 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C8 kevent_va=30084018 prio=0 lr=824AA304 K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C8 result=00000000 lr=824AC578 guest_lr=822DFED0 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 F> F8000098 DiscImageDevice::ResolvePath(\hidden\Resource3D) K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000A8 type=1 initial_state=0 lr=824A9F6C K> F8000098 AUDIT-HLC NtCreateEvent_inner handle=F80000A8 kevent_va=30068018 lr=824A9F6C K> F8000098 AUDIT-HLC NtDuplicateObject src=F80000A8 dst=F80000AC options=00000002 lr=824AA3B4 K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A8 alertable=0 lr=824AC578 guest_lr=822DFCC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtSetEvent handle=F80000AC lr=824AA304 guest_lr=82450DF4 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000A8 kevent_va=30068018 prio=0 lr=824AA304 K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000A8 result=00000000 lr=824AC578 guest_lr=822DFCC8 K> F8000098 AUDIT-HLC NtDuplicateObject src=F80000A8 dst=F80000AC options=00000002 lr=824AA3B4 K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A8 alertable=0 lr=824AC578 guest_lr=822DFE24 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtSetEvent handle=F80000AC lr=824AA304 guest_lr=82450DF4 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000A8 kevent_va=30068018 prio=0 lr=824AA304 K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000A8 result=00000000 lr=824AC578 guest_lr=822DFE24 K> F8000098 AUDIT-HLC NtDuplicateObject src=F80000A8 dst=F80000AC options=00000002 lr=824AA3B4 K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A8 alertable=0 lr=824AC578 guest_lr=822DFED0 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000034 lr=824AA304 guest_lr=821CC1B8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000008 AUDIT-HLC XEvent::Set handle=F8000034 kevent_va=30045018 prio=0 lr=824AA304 K> F8000064 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000034 result=00000000 lr=824AC578 guest_lr=822F1FC8 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000007 r5=828F3888 r6=701CF924 r7=00000000 r8=00000002 r9=00000000 r10=0000002E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: 00000000 00000001 30057018 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000002 r5=828F3888 r6=701CF924 r7=00000000 r8=00000003 r9=00000000 r10=00000031 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000008 AUDIT-HLC XEvent::Set handle=F8000108 kevent_va=00000000 prio=1 lr=823DF714 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000004 r9=00000000 r10=00000032 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtSetEvent handle=F80000AC lr=824AA304 guest_lr=82450DF4 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000A8 kevent_va=30068018 prio=0 lr=824AA304 K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000A8 result=00000000 lr=824AC578 guest_lr=822DFED0 F> F8000098 DiscImageDevice::ResolvePath(\hidden\Resource3D) K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000A8 type=1 initial_state=0 lr=824A9F6C K> F8000098 AUDIT-HLC NtCreateEvent_inner handle=F80000A8 kevent_va=30068018 lr=824A9F6C K> F8000098 AUDIT-HLC NtDuplicateObject src=F80000A8 dst=F80000AC options=00000002 lr=824AA3B4 K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A8 alertable=0 lr=824AC578 guest_lr=822DFCC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtSetEvent handle=F80000AC lr=824AA304 guest_lr=82450DF4 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000A8 kevent_va=30068018 prio=0 lr=824AA304 K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000A8 result=00000000 lr=824AC578 guest_lr=822DFCC8 K> F8000098 AUDIT-HLC NtDuplicateObject src=F80000A8 dst=F80000AC options=00000002 lr=824AA3B4 K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A8 alertable=0 lr=824AC578 guest_lr=822DFE24 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000084 AUDIT-HLC XEvent::Set handle=F80000C8 kevent_va=00000000 prio=1 lr=827EED8C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtSetEvent handle=F80000AC lr=824AA304 guest_lr=82450DF4 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000A8 kevent_va=30068018 prio=0 lr=824AA304 K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000A8 result=00000000 lr=824AC578 guest_lr=822DFE24 K> F8000098 AUDIT-HLC NtDuplicateObject src=F80000A8 dst=F80000AC options=00000002 lr=824AA3B4 K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A8 alertable=0 lr=824AC578 guest_lr=822DFED0 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtSetEvent handle=F80000AC lr=824AA304 guest_lr=82450DF4 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000A8 kevent_va=30068018 prio=0 lr=824AA304 K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000A8 result=00000000 lr=824AC578 guest_lr=822DFED0 F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\f\ca5c62e) K> F800006C AUDIT-HLC XEvent::Set handle=F80000C8 kevent_va=00000000 prio=1 lr=827E843C K> F8000098 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C K> F8000098 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30068018 lr=824A9F6C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\d\14ba3f8) K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\d) K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F800008C alertable=0 lr=824AC578 guest_lr=8245FA10 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C K> F8000084 AUDIT-HLC XEvent::Set handle=F80000C8 kevent_va=00000000 prio=1 lr=827ED704 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C !> F8000044 BaseHeap::Release failed because address is not a region start !> F8000044 PhysicalHeap::Release failed due to parent heap failure !> F8000044 BaseHeap::Release failed because address is not a region start !> F8000044 PhysicalHeap::Release failed due to parent heap failure K> F8000044 AUDIT-HLC NtDuplicateObject src=F800008C dst=F80000AC options=00000002 lr=824AA3B4 K> F8000044 AUDIT-HLC NtSetEvent handle=F80000AC lr=824AA304 guest_lr=82460EC0 K> F8000044 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=30068018 prio=0 lr=824AA304 K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800008C result=00000000 lr=824AC578 guest_lr=8245FA10 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\8\14c242d) K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000098 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C K> F8000098 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30068018 lr=824A9F6C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000005 r9=00000000 r10=00000033 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\5\6324af0) K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\5) K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F800008C alertable=0 lr=824AC578 guest_lr=8245FA10 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtDuplicateObject src=F800008C dst=F80000AC options=00000002 lr=824AA3B4 K> F8000044 AUDIT-HLC NtSetEvent handle=F80000AC lr=824AA304 guest_lr=82460EC0 K> F8000044 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=30068018 prio=0 lr=824AA304 K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800008C result=00000000 lr=824AC578 guest_lr=8245FA10 F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\d\70a9531) K> F8000098 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C K> F8000098 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30068018 lr=824A9F6C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\a\c9606f9) F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\a) K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F800008C alertable=0 lr=824AC578 guest_lr=8245FA10 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtDuplicateObject src=F800008C dst=F80000AC options=00000002 lr=824AA3B4 K> F8000044 AUDIT-HLC NtSetEvent handle=F80000AC lr=824AA304 guest_lr=82460EC0 K> F8000044 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=30068018 prio=0 lr=824AA304 K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800008C result=00000000 lr=824AC578 guest_lr=8245FA10 F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\7\9f2d535) K> F8000098 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C K> F8000098 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30068018 lr=824A9F6C F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\4\efaecd1) F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\4) K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F800008C alertable=0 lr=824AC578 guest_lr=8245FA10 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000044 AUDIT-HLC NtDuplicateObject src=F800008C dst=F80000AC options=00000002 lr=824AA3B4 K> F8000044 AUDIT-HLC NtSetEvent handle=F80000AC lr=824AA304 guest_lr=82460EC0 K> F8000044 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=30068018 prio=0 lr=824AA304 K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800008C result=00000000 lr=824AC578 guest_lr=8245FA10 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\7\0c3bba2) K> F8000098 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C K> F8000098 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30068018 lr=824A9F6C F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\4\59fbfe8) F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\4) K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F800008C alertable=0 lr=824AC578 guest_lr=8245FA10 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=3007E018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000AC kevent_va=3007E018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000AC kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtDuplicateObject src=F800008C dst=F80000AC options=00000002 lr=824AA3B4 K> F8000044 AUDIT-HLC NtSetEvent handle=F80000AC lr=824AA304 guest_lr=82460EC0 K> F8000044 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=30068018 prio=0 lr=824AA304 K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800008C result=00000000 lr=824AC578 guest_lr=8245FA10 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000006 r9=00000000 r10=00000034 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC XEvent::Set handle=F80000C8 kevent_va=00000000 prio=1 lr=827ECBB8 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC XEvent::Set handle=F80000C8 kevent_va=00000000 prio=1 lr=827E843C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC XEvent::Set handle=F80000C8 kevent_va=00000000 prio=1 lr=827E9C9C K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC XEvent::Set handle=F80000C8 kevent_va=00000000 prio=1 lr=827E843C K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000007 r9=00000000 r10=00000035 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000008 r9=00000000 r10=00000036 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000009 r9=00000000 r10=00000037 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000000A r9=00000000 r10=00000038 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000000B r9=00000000 r10=00000039 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000000C r9=00000000 r10=0000003A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000000D r9=00000000 r10=0000003B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000000E r9=00000000 r10=0000003C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000000F r9=00000000 r10=0000003D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000010 r9=00000000 r10=0000003E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000011 r9=00000000 r10=0000003F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000012 r9=00000000 r10=00000040 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000013 r9=00000000 r10=00000041 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000014 r9=00000000 r10=00000042 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000015 r9=00000000 r10=00000043 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000016 r9=00000000 r10=00000044 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000017 r9=00000000 r10=00000045 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000018 r9=00000000 r10=00000046 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000019 r9=00000000 r10=00000047 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000001A r9=00000000 r10=00000048 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000001B r9=00000000 r10=00000049 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000001C r9=00000000 r10=0000004A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000001D r9=00000000 r10=0000004B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000001E r9=00000000 r10=0000004C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000001F r9=00000000 r10=0000004D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000020 r9=00000000 r10=0000004E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000021 r9=00000000 r10=0000004F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000022 r9=00000000 r10=00000050 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000023 r9=00000000 r10=00000051 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000024 r9=00000000 r10=00000052 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000025 r9=00000000 r10=00000053 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000026 r9=00000000 r10=00000054 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000027 r9=00000000 r10=00000055 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000028 r9=00000000 r10=00000056 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000029 r9=00000000 r10=00000057 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000002A r9=00000000 r10=00000058 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000002B r9=00000000 r10=00000059 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000002C r9=00000000 r10=0000005A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000002D r9=00000000 r10=0000005B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000002E r9=00000000 r10=0000005C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000002F r9=00000000 r10=0000005D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000030 r9=00000000 r10=0000005E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000031 r9=00000000 r10=0000005F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000032 r9=00000000 r10=00000060 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000033 r9=00000000 r10=00000061 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000034 r9=00000000 r10=00000062 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000035 r9=00000000 r10=00000063 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000036 r9=00000000 r10=00000064 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000037 r9=00000000 r10=00000065 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000038 r9=00000000 r10=00000066 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000039 r9=00000000 r10=00000067 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000003A r9=00000000 r10=00000068 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000003B r9=00000000 r10=00000069 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000003C r9=00000000 r10=0000006A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000003D r9=00000000 r10=0000006B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000003E r9=00000000 r10=0000006C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000003F r9=00000000 r10=0000006D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000040 r9=00000000 r10=0000006E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000041 r9=00000000 r10=0000006F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000042 r9=00000000 r10=00000070 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000043 r9=00000000 r10=00000071 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000044 r9=00000000 r10=00000072 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000045 r9=00000000 r10=00000073 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000046 r9=00000000 r10=00000074 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000047 r9=00000000 r10=00000075 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000048 r9=00000000 r10=00000076 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000049 r9=00000000 r10=00000077 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000004A r9=00000000 r10=00000078 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000004B r9=00000000 r10=00000079 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000004C r9=00000000 r10=0000007A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000004D r9=00000000 r10=0000007B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000004E r9=00000000 r10=0000007C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000004F r9=00000000 r10=0000007D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000050 r9=00000000 r10=0000007E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000051 r9=00000000 r10=0000007F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000052 r9=00000000 r10=00000080 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000053 r9=00000000 r10=00000081 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000054 r9=00000000 r10=00000082 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000055 r9=00000000 r10=00000083 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000056 r9=00000000 r10=00000084 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000057 r9=00000000 r10=00000085 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000058 r9=00000000 r10=00000086 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000059 r9=00000000 r10=00000087 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000005A r9=00000000 r10=00000088 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000005B r9=00000000 r10=00000089 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000005C r9=00000000 r10=0000008A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000005D r9=00000000 r10=0000008B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000005E r9=00000000 r10=0000008C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000005F r9=00000000 r10=0000008D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000060 r9=00000000 r10=0000008E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000061 r9=00000000 r10=0000008F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000062 r9=00000000 r10=00000090 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000063 r9=00000000 r10=00000091 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000064 r9=00000000 r10=00000092 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000065 r9=00000000 r10=00000093 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000066 r9=00000000 r10=00000094 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000067 r9=00000000 r10=00000095 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000068 r9=00000000 r10=00000096 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000069 r9=00000000 r10=00000097 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000006A r9=00000000 r10=00000098 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000006B r9=00000000 r10=00000099 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000006C r9=00000000 r10=0000009A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000006D r9=00000000 r10=0000009B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000006E r9=00000000 r10=0000009C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000006F r9=00000000 r10=0000009D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000070 r9=00000000 r10=0000009E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000071 r9=00000000 r10=0000009F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000072 r9=00000000 r10=000000A0 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000073 r9=00000000 r10=000000A1 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000074 r9=00000000 r10=000000A2 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000075 r9=00000000 r10=000000A3 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000076 r9=00000000 r10=000000A4 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000077 r9=00000000 r10=000000A5 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000078 r9=00000000 r10=000000A6 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000079 r9=00000000 r10=000000A7 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000007A r9=00000000 r10=000000A8 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000007B r9=00000000 r10=000000A9 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000007C r9=00000000 r10=000000AA lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000007D r9=00000000 r10=000000AB lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000007E r9=00000000 r10=000000AC lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000007F r9=00000000 r10=000000AD lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000080 r9=00000000 r10=000000AE lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000081 r9=00000000 r10=000000AF lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000082 r9=00000000 r10=000000B0 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000083 r9=00000000 r10=000000B1 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000084 r9=00000000 r10=000000B2 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000085 r9=00000000 r10=000000B3 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000086 r9=00000000 r10=000000B4 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000087 r9=00000000 r10=000000B5 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000088 r9=00000000 r10=000000B6 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000089 r9=00000000 r10=000000B7 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000008A r9=00000000 r10=000000B8 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000008B r9=00000000 r10=000000B9 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000008C r9=00000000 r10=000000BA lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000008D r9=00000000 r10=000000BB lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000008E r9=00000000 r10=000000BC lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000008F r9=00000000 r10=000000BD lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000090 r9=00000000 r10=000000BE lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000091 r9=00000000 r10=000000BF lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000092 r9=00000000 r10=000000C0 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000093 r9=00000000 r10=000000C1 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000094 r9=00000000 r10=000000C2 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000095 r9=00000000 r10=000000C3 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000096 r9=00000000 r10=000000C4 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000097 r9=00000000 r10=000000C5 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000098 r9=00000000 r10=000000C6 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000099 r9=00000000 r10=000000C7 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000009A r9=00000000 r10=000000C8 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000009B r9=00000000 r10=000000C9 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000009C r9=00000000 r10=000000CA lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000009D r9=00000000 r10=000000CB lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000009E r9=00000000 r10=000000CC lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000009F r9=00000000 r10=000000CD lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000A0 r9=00000000 r10=000000CE lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000A1 r9=00000000 r10=000000CF lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000A2 r9=00000000 r10=000000D0 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000A3 r9=00000000 r10=000000D1 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000A4 r9=00000000 r10=000000D2 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000A5 r9=00000000 r10=000000D3 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000A6 r9=00000000 r10=000000D4 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000A7 r9=00000000 r10=000000D5 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000A8 r9=00000000 r10=000000D6 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000A9 r9=00000000 r10=000000D7 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000AA r9=00000000 r10=000000D8 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000AB r9=00000000 r10=000000D9 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000AC r9=00000000 r10=000000DA lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000AD r9=00000000 r10=000000DB lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000AE r9=00000000 r10=000000DC lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000AF r9=00000000 r10=000000DD lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000B0 r9=00000000 r10=000000DE lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000B1 r9=00000000 r10=000000DF lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000B2 r9=00000000 r10=000000E0 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000B3 r9=00000000 r10=000000E1 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000B4 r9=00000000 r10=000000E2 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000B5 r9=00000000 r10=000000E3 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000B6 r9=00000000 r10=000000E4 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000B7 r9=00000000 r10=000000E5 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000B8 r9=00000000 r10=000000E6 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000B9 r9=00000000 r10=000000E7 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000BA r9=00000000 r10=000000E8 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000BB r9=00000000 r10=000000E9 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000BC r9=00000000 r10=000000EA lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000BD r9=00000000 r10=000000EB lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000BE r9=00000000 r10=000000EC lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000BF r9=00000000 r10=000000ED lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000C0 r9=00000000 r10=000000EE lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000C1 r9=00000000 r10=000000EF lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000C2 r9=00000000 r10=000000F0 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000C3 r9=00000000 r10=000000F1 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000C4 r9=00000000 r10=000000F2 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000C5 r9=00000000 r10=000000F3 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000C6 r9=00000000 r10=000000F4 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000C7 r9=00000000 r10=000000F5 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000C8 r9=00000000 r10=000000F6 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000C9 r9=00000000 r10=000000F7 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000CA r9=00000000 r10=000000F8 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000CB r9=00000000 r10=000000F9 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000CC r9=00000000 r10=000000FA lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000CD r9=00000000 r10=000000FB lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000CE r9=00000000 r10=000000FC lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000CF r9=00000000 r10=000000FD lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000D0 r9=00000000 r10=000000FE lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000D1 r9=00000000 r10=000000FF lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000D2 r9=00000000 r10=00000100 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000D3 r9=00000000 r10=00000101 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000D4 r9=00000000 r10=00000102 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000D5 r9=00000000 r10=00000103 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000D6 r9=00000000 r10=00000104 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000D7 r9=00000000 r10=00000105 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000D8 r9=00000000 r10=00000106 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000D9 r9=00000000 r10=00000107 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000DA r9=00000000 r10=00000108 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000DB r9=00000000 r10=00000109 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000DC r9=00000000 r10=0000010A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000DD r9=00000000 r10=0000010B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000DE r9=00000000 r10=0000010C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000DF r9=00000000 r10=0000010D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC XEvent::Set handle=F80000C8 kevent_va=00000000 prio=1 lr=827E843C K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000E0 r9=00000000 r10=0000010E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000E1 r9=00000000 r10=0000010F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000E2 r9=00000000 r10=00000110 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000E3 r9=00000000 r10=00000111 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000E4 r9=00000000 r10=00000112 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000E5 r9=00000000 r10=00000113 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000E6 r9=00000000 r10=00000114 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000E7 r9=00000000 r10=00000115 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000E8 r9=00000000 r10=00000116 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000E9 r9=00000000 r10=00000117 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000EA r9=00000000 r10=00000118 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000EB r9=00000000 r10=00000119 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000EC r9=00000000 r10=0000011A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000ED r9=00000000 r10=0000011B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000EE r9=00000000 r10=0000011C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000EF r9=00000000 r10=0000011D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000F0 r9=00000000 r10=0000011E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000F1 r9=00000000 r10=0000011F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000F2 r9=00000000 r10=00000120 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000F3 r9=00000000 r10=00000121 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000F4 r9=00000000 r10=00000122 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000F5 r9=00000000 r10=00000123 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000F6 r9=00000000 r10=00000124 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000F7 r9=00000000 r10=00000125 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000F8 r9=00000000 r10=00000126 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000094 alertable=0 lr=824AC578 guest_lr=823DEF4C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000094 result=00000000 lr=824AC578 guest_lr=823DEF4C K> F8000008 AUDIT-HLC NtSetEvent handle=F8000094 lr=824AA304 guest_lr=821C7D3C K> F8000008 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=3006E018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=03A723D0 r8=000000F9 r9=00000000 r10=00000127 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000FA r9=00000000 r10=00000128 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000FB r9=00000000 r10=00000129 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30068018 lr=824A9F6C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800008C alertable=0 lr=824AC578 guest_lr=821CC19C K> F8000064 AUDIT-HLC NtSetEvent handle=F800008C lr=824AA304 guest_lr=822F1FC8 K> F8000064 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=30068018 prio=0 lr=824AA304 K> F8000064 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000034 alertable=0 lr=824AC578 guest_lr=822F1FC8 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800008C result=00000000 lr=824AC578 guest_lr=821CC19C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC NtSetEvent handle=F8000034 lr=824AA304 guest_lr=821CC1B8 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000034 kevent_va=30045018 prio=0 lr=824AA304 K> F8000064 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000034 result=00000000 lr=824AC578 guest_lr=822F1FC8 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000FC r9=00000000 r10=0000012A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: 00000000 00000001 30057018 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000FD r9=00000000 r10=0000012B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000FE r9=00000000 r10=0000012C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000000FF r9=00000000 r10=0000012D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000100 r9=00000000 r10=0000012E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000101 r9=00000000 r10=0000012F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000102 r9=00000000 r10=00000130 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000103 r9=00000000 r10=00000131 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000104 r9=00000000 r10=00000132 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000105 r9=00000000 r10=00000133 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000106 r9=00000000 r10=00000134 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000107 r9=00000000 r10=00000135 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000108 r9=00000000 r10=00000136 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000109 r9=00000000 r10=00000137 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000010A r9=00000000 r10=00000138 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000010B r9=00000000 r10=00000139 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000010C r9=00000000 r10=0000013A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000010D r9=00000000 r10=0000013B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000010E r9=00000000 r10=0000013C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000010F r9=00000000 r10=0000013D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000110 r9=00000000 r10=0000013E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000111 r9=00000000 r10=0000013F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000112 r9=00000000 r10=00000140 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000113 r9=00000000 r10=00000141 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000114 r9=00000000 r10=00000142 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000115 r9=00000000 r10=00000143 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000116 r9=00000000 r10=00000144 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000117 r9=00000000 r10=00000145 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000118 r9=00000000 r10=00000146 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000119 r9=00000000 r10=00000147 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000011A r9=00000000 r10=00000148 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000011B r9=00000000 r10=00000149 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000011C r9=00000000 r10=0000014A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000011D r9=00000000 r10=0000014B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000011E r9=00000000 r10=0000014C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000011F r9=00000000 r10=0000014D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000120 r9=00000000 r10=0000014E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000121 r9=00000000 r10=0000014F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000122 r9=00000000 r10=00000150 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000123 r9=00000000 r10=00000151 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000124 r9=00000000 r10=00000152 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000125 r9=00000000 r10=00000153 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000126 r9=00000000 r10=00000154 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000127 r9=00000000 r10=00000155 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000128 r9=00000000 r10=00000156 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000129 r9=00000000 r10=00000157 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000012A r9=00000000 r10=00000158 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000012B r9=00000000 r10=00000159 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000012C r9=00000000 r10=0000015A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000012D r9=00000000 r10=0000015B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000012E r9=00000000 r10=0000015C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000012F r9=00000000 r10=0000015D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000130 r9=00000000 r10=0000015E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000131 r9=00000000 r10=0000015F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000132 r9=00000000 r10=00000160 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000133 r9=00000000 r10=00000161 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000134 r9=00000000 r10=00000162 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000135 r9=00000000 r10=00000163 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000136 r9=00000000 r10=00000164 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000137 r9=00000000 r10=00000165 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000138 r9=00000000 r10=00000166 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000139 r9=00000000 r10=00000167 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000013A r9=00000000 r10=00000168 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000013B r9=00000000 r10=00000169 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000013C r9=00000000 r10=0000016A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000013D r9=00000000 r10=0000016B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000013E r9=00000000 r10=0000016C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000013F r9=00000000 r10=0000016D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000140 r9=00000000 r10=0000016E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000141 r9=00000000 r10=0000016F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000142 r9=00000000 r10=00000170 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000143 r9=00000000 r10=00000171 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000144 r9=00000000 r10=00000172 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000145 r9=00000000 r10=00000173 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000146 r9=00000000 r10=00000174 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000147 r9=00000000 r10=00000175 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000148 r9=00000000 r10=00000176 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000149 r9=00000000 r10=00000177 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000014A r9=00000000 r10=00000178 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000014B r9=00000000 r10=00000179 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000014C r9=00000000 r10=0000017A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000014D r9=00000000 r10=0000017B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000014E r9=00000000 r10=0000017C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000014F r9=00000000 r10=0000017D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000150 r9=00000000 r10=0000017E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000151 r9=00000000 r10=0000017F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000152 r9=00000000 r10=00000180 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000153 r9=00000000 r10=00000181 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000154 r9=00000000 r10=00000182 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000155 r9=00000000 r10=00000183 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000156 r9=00000000 r10=00000184 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000157 r9=00000000 r10=00000185 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000158 r9=00000000 r10=00000186 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000159 r9=00000000 r10=00000187 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000015A r9=00000000 r10=00000188 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000015B r9=00000000 r10=00000189 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000015C r9=00000000 r10=0000018A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000015D r9=00000000 r10=0000018B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000015E r9=00000000 r10=0000018C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000015F r9=00000000 r10=0000018D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000160 r9=00000000 r10=0000018E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000161 r9=00000000 r10=0000018F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000162 r9=00000000 r10=00000190 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000163 r9=00000000 r10=00000191 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000164 r9=00000000 r10=00000192 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000165 r9=00000000 r10=00000193 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000166 r9=00000000 r10=00000194 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000167 r9=00000000 r10=00000195 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000168 r9=00000000 r10=00000196 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000169 r9=00000000 r10=00000197 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000016A r9=00000000 r10=00000198 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000016B r9=00000000 r10=00000199 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000016C r9=00000000 r10=0000019A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000016D r9=00000000 r10=0000019B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000016E r9=00000000 r10=0000019C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000016F r9=00000000 r10=0000019D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000170 r9=00000000 r10=0000019E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000171 r9=00000000 r10=0000019F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000172 r9=00000000 r10=000001A0 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000173 r9=00000000 r10=000001A1 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000174 r9=00000000 r10=000001A2 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000175 r9=00000000 r10=000001A3 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000176 r9=00000000 r10=000001A4 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000177 r9=00000000 r10=000001A5 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000178 r9=00000000 r10=000001A6 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000179 r9=00000000 r10=000001A7 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000017A r9=00000000 r10=000001A8 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000017B r9=00000000 r10=000001A9 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000017C r9=00000000 r10=000001AA lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000017D r9=00000000 r10=000001AB lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000017E r9=00000000 r10=000001AC lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000017F r9=00000000 r10=000001AD lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000180 r9=00000000 r10=000001AE lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000181 r9=00000000 r10=000001AF lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000182 r9=00000000 r10=000001B0 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000183 r9=00000000 r10=000001B1 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000184 r9=00000000 r10=000001B2 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000185 r9=00000000 r10=000001B3 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000186 r9=00000000 r10=000001B4 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000187 r9=00000000 r10=000001B5 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000188 r9=00000000 r10=000001B6 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000189 r9=00000000 r10=000001B7 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000018A r9=00000000 r10=000001B8 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000018B r9=00000000 r10=000001B9 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000018C r9=00000000 r10=000001BA lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000018D r9=00000000 r10=000001BB lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000018E r9=00000000 r10=000001BC lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000018F r9=00000000 r10=000001BD lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000190 r9=00000000 r10=000001BE lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000191 r9=00000000 r10=000001BF lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000192 r9=00000000 r10=000001C0 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000193 r9=00000000 r10=000001C1 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000194 r9=00000000 r10=000001C2 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000195 r9=00000000 r10=000001C3 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000196 r9=00000000 r10=000001C4 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000197 r9=00000000 r10=000001C5 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000198 r9=00000000 r10=000001C6 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000199 r9=00000000 r10=000001C7 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000019A r9=00000000 r10=000001C8 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000019B r9=00000000 r10=000001C9 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000019C r9=00000000 r10=000001CA lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000019D r9=00000000 r10=000001CB lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000019E r9=00000000 r10=000001CC lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000019F r9=00000000 r10=000001CD lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001A0 r9=00000000 r10=000001CE lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001A1 r9=00000000 r10=000001CF lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001A2 r9=00000000 r10=000001D0 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001A3 r9=00000000 r10=000001D1 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001A4 r9=00000000 r10=000001D2 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001A5 r9=00000000 r10=000001D3 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001A6 r9=00000000 r10=000001D4 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001A7 r9=00000000 r10=000001D5 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001A8 r9=00000000 r10=000001D6 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001A9 r9=00000000 r10=000001D7 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001AA r9=00000000 r10=000001D8 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001AB r9=00000000 r10=000001D9 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001AC r9=00000000 r10=000001DA lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001AD r9=00000000 r10=000001DB lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001AE r9=00000000 r10=000001DC lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001AF r9=00000000 r10=000001DD lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001B0 r9=00000000 r10=000001DE lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001B1 r9=00000000 r10=000001DF lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001B2 r9=00000000 r10=000001E0 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001B3 r9=00000000 r10=000001E1 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001B4 r9=00000000 r10=000001E2 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001B5 r9=00000000 r10=000001E3 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001B6 r9=00000000 r10=000001E4 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001B7 r9=00000000 r10=000001E5 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001B8 r9=00000000 r10=000001E6 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001B9 r9=00000000 r10=000001E7 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001BA r9=00000000 r10=000001E8 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001BB r9=00000000 r10=000001E9 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001BC r9=00000000 r10=000001EA lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001BD r9=00000000 r10=000001EB lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001BE r9=00000000 r10=000001EC lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001BF r9=00000000 r10=000001ED lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001C0 r9=00000000 r10=000001EE lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001C1 r9=00000000 r10=000001EF lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001C2 r9=00000000 r10=000001F0 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001C3 r9=00000000 r10=000001F1 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001C4 r9=00000000 r10=000001F2 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001C5 r9=00000000 r10=000001F3 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001C6 r9=00000000 r10=000001F4 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001C7 r9=00000000 r10=000001F5 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001C8 r9=00000000 r10=000001F6 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001C9 r9=00000000 r10=000001F7 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001CA r9=00000000 r10=000001F8 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001CB r9=00000000 r10=000001F9 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001CC r9=00000000 r10=000001FA lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001CD r9=00000000 r10=000001FB lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001CE r9=00000000 r10=000001FC lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000094 alertable=0 lr=824AC578 guest_lr=823DEF4C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000094 result=00000000 lr=824AC578 guest_lr=823DEF4C K> F8000008 AUDIT-HLC NtSetEvent handle=F8000094 lr=824AA304 guest_lr=821C7D3C K> F8000008 AUDIT-HLC XEvent::Set handle=F8000094 kevent_va=3006E018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=03A723D0 r8=000001CF r9=00000000 r10=000001FD lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001D0 r9=00000000 r10=000001FE lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001D1 r9=00000000 r10=000001FF lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001D2 r9=00000000 r10=00000200 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30068018 lr=824A9F6C K> F8000008 AUDIT-HLC ExCreateThread entry=821748F0 start_ctx=BC366DA0 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=82174828 i> F8000008 XThreadF80000A8 (1A) Stack: 70880000-70900000 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F80000A8 XThread::Execute thid 26 (handle=F80000A8, 'XThread0218 (F80000A8)', native=00000218) K> F80000A8 AUDIT-HLC XThread::Execute tid=26 start_address=821748F0 start_context=BC366DA0 xapi=824AFF88 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F80000A8 AUDIT-HLC NtCreateEvent handle=F80000AC type=1 initial_state=1 lr=824A9F6C K> F80000A8 AUDIT-HLC NtCreateEvent_inner handle=F80000AC kevent_va=30084018 lr=824A9F6C K> F80000A8 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C K> F80000A8 AUDIT-HLC NtCreateEvent_inner handle=F80000B4 kevent_va=300B0018 lr=824A9F6C F> F80000A8 HostPathDevice::ResolvePath(\aab216c3\5\c10eae6) F> F80000A8 HostPathDevice::ResolvePath(\aab216c3\5) K> F80000A8 AUDIT-HLC NtDuplicateObject src=F80000B4 dst=F800010C options=00000002 lr=824AA3B4 K> F80000A8 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B4 alertable=0 lr=824AC578 guest_lr=821CBAE0 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000110 kevent_va=300B2018 lr=824A9F6C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001D3 r9=00000000 r10=00000201 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001D4 r9=00000000 r10=00000202 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001D5 r9=00000000 r10=00000203 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001D6 r9=00000000 r10=00000204 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001D7 r9=00000000 r10=00000205 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001D8 r9=00000000 r10=00000206 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001D9 r9=00000000 r10=00000207 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001DA r9=00000000 r10=00000208 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001DB r9=00000000 r10=00000209 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC XEvent::Set handle=F80000C8 kevent_va=00000000 prio=1 lr=827ED1E4 K> F800006C AUDIT-HLC XEvent::Set handle=F80000C8 kevent_va=00000000 prio=1 lr=827E843C K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001DC r9=00000000 r10=0000020A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001DD r9=00000000 r10=0000020B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001DE r9=00000000 r10=0000020C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001DF r9=00000000 r10=0000020D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001E0 r9=00000000 r10=0000020E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001E1 r9=00000000 r10=0000020F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001E2 r9=00000000 r10=00000210 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001E3 r9=00000000 r10=00000211 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001E4 r9=00000000 r10=00000212 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001E5 r9=00000000 r10=00000213 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001E6 r9=00000000 r10=00000214 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001E7 r9=00000000 r10=00000215 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001E8 r9=00000000 r10=00000216 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001E9 r9=00000000 r10=00000217 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001EA r9=00000000 r10=00000218 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC XEvent::Set handle=F80000C8 kevent_va=00000000 prio=1 lr=827E843C K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001EB r9=00000000 r10=00000219 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001EC r9=00000000 r10=0000021A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001ED r9=00000000 r10=0000021B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001EE r9=00000000 r10=0000021C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001EF r9=00000000 r10=0000021D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001F0 r9=00000000 r10=0000021E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001F1 r9=00000000 r10=0000021F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001F2 r9=00000000 r10=00000220 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001F3 r9=00000000 r10=00000221 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001F4 r9=00000000 r10=00000222 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001F5 r9=00000000 r10=00000223 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001F6 r9=00000000 r10=00000224 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001F7 r9=00000000 r10=00000225 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001F8 r9=00000000 r10=00000226 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001F9 r9=00000000 r10=00000227 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001FA r9=00000000 r10=00000228 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001FB r9=00000000 r10=00000229 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001FC r9=00000000 r10=0000022A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001FD r9=00000000 r10=0000022B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001FE r9=00000000 r10=0000022C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000001FF r9=00000000 r10=0000022D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000200 r9=00000000 r10=0000022E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000201 r9=00000000 r10=0000022F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000202 r9=00000000 r10=00000230 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000203 r9=00000000 r10=00000231 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=300B2018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=300B2018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F8000110 kevent_va=300B2018 lr=824A9F6C K> F8000044 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000110 alertable=0 lr=824AC578 guest_lr=8245148C K> F8000054 AUDIT-HLC NtSetEvent handle=F8000110 lr=824AA304 guest_lr=82457F18 K> F8000054 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=300B2018 prio=0 lr=824AA304 K> F8000044 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000110 result=00000000 lr=824AC578 guest_lr=8245148C K> F8000044 AUDIT-HLC NtSetEvent handle=F800010C lr=824AA304 guest_lr=82450DF4 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=300B0018 prio=0 lr=824AA304 K> F80000A8 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B4 result=00000000 lr=824AC578 guest_lr=821CBAE0 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000204 r9=00000000 r10=00000232 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F80000A8 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=00000000 prio=1 lr=8217B148 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000084 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000084 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 F> F8000084 DiscImageDevice::ResolvePath(\dat) K> F8000084 AUDIT-HLC NtDuplicateObject src=F80000C0 dst=F8000110 options=00000002 lr=824AA3B4 K> F8000084 AUDIT-HLC NtSetEvent handle=F8000110 lr=824AA304 guest_lr=82460078 K> F8000084 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=82460150 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=82460150 K> F8000084 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=00000000 prio=1 lr=82178D9C K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000205 r9=00000000 r10=00000233 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=00000000 prio=1 lr=82178D9C K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000206 r9=00000000 r10=00000234 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=00000000 prio=1 lr=82178D9C K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000207 r9=00000000 r10=00000235 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=00000000 prio=1 lr=82178D9C K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000208 r9=00000000 r10=00000236 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=00000000 prio=1 lr=82178D9C K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000209 r9=00000000 r10=00000237 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=00000000 prio=1 lr=82178D9C K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000020A r9=00000000 r10=00000238 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=00000000 prio=1 lr=82178D9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C K> F8000044 AUDIT-HLC NtCreateEvent_inner handle=F80000C0 kevent_va=300B0018 lr=824A9F6C K> F8000044 AUDIT-HLC NtReadFile_signal_event handle=F80000C0 kevent_va=300B0018 lr=824AAFC8 K> F8000044 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=300B0018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000020B r9=00000000 r10=00000239 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=00000000 prio=1 lr=824D11A0 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=00000000 prio=1 lr=824D0978 K> F800006C AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=00000000 prio=1 lr=824D08C0 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000020C r9=00000000 r10=0000023A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000084 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=00000000 prio=1 lr=82178D9C K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F80000A8 AUDIT-HLC XEvent::Set handle=F80000B4 kevent_va=00000000 prio=1 lr=8217C6F4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000020D r9=00000000 r10=0000023B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365BC0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001F 00000001 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000001 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000001 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F800008C kevent_va=30068018 lr=824A9F6C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800008C alertable=0 lr=824AC578 guest_lr=82172BC8 K> F8000064 AUDIT-HLC NtSetEvent handle=F800008C lr=824AA304 guest_lr=822F1FC8 K> F8000064 AUDIT-HLC XEvent::Set handle=F800008C kevent_va=30068018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800008C result=00000000 lr=824AC578 guest_lr=82172BC8 K> F8000064 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000034 alertable=0 lr=824AC578 guest_lr=822F1FC8 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C F> F8000008 DiscImageDevice::ResolvePath(\dat\movie) K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=1 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000110 kevent_va=3007E018 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=1 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000114 kevent_va=30080018 lr=824A9F6C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000118 type=0 initial_state=1 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000118 kevent_va=300B0018 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent handle=F800011C type=0 initial_state=1 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F800011C kevent_va=300B2018 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000120 type=0 initial_state=1 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000120 kevent_va=300B4018 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000124 type=0 initial_state=1 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000124 kevent_va=300B6018 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000128 type=0 initial_state=1 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000128 kevent_va=300B8018 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent handle=F800012C type=0 initial_state=1 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F800012C kevent_va=300BA018 lr=824A9F6C K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=3007E018 lr=824AAFC8 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000114 kevent_va=30080018 lr=824AAFC8 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000114 kevent_va=30080018 prio=0 lr=824AAFC8 K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=300B0018 lr=824AAFC8 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=300B0018 prio=0 lr=824AAFC8 K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F800011C kevent_va=300B2018 lr=824AAFC8 K> F8000008 AUDIT-HLC XEvent::Set handle=F800011C kevent_va=300B2018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B4018 lr=824AAFC8 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B4018 prio=0 lr=824AAFC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B6018 lr=824AAFC8 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B6018 prio=0 lr=824AAFC8 K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B8018 lr=824AAFC8 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B8018 prio=0 lr=824AAFC8 K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F800012C kevent_va=300BA018 lr=824AAFC8 K> F8000008 AUDIT-HLC XEvent::Set handle=F800012C kevent_va=300BA018 prio=0 lr=824AAFC8 F> F8000008 DiscImageDevice::ResolvePath(\dat\movie) K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000134 type=0 initial_state=1 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000134 kevent_va=300BC018 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000138 type=0 initial_state=1 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000138 kevent_va=300BE018 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent handle=F800013C type=0 initial_state=1 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F800013C kevent_va=300C0018 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000140 type=0 initial_state=1 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000140 kevent_va=300C2018 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000144 type=0 initial_state=1 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000144 kevent_va=300C4018 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000148 type=0 initial_state=1 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000148 kevent_va=300C6018 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent handle=F800014C type=0 initial_state=1 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F800014C kevent_va=300C8018 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000150 type=0 initial_state=1 lr=824A9F6C K> F8000008 AUDIT-HLC NtCreateEvent_inner handle=F8000150 kevent_va=300CA018 lr=824A9F6C K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BC018 lr=824AAFC8 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BC018 prio=0 lr=824AAFC8 K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000138 kevent_va=300BE018 lr=824AAFC8 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000138 kevent_va=300BE018 prio=0 lr=824AAFC8 K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300C0018 lr=824AAFC8 K> F8000008 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300C0018 prio=0 lr=824AAFC8 K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300C2018 lr=824AAFC8 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300C2018 prio=0 lr=824AAFC8 K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C4018 lr=824AAFC8 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C4018 prio=0 lr=824AAFC8 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C6018 lr=824AAFC8 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C6018 prio=0 lr=824AAFC8 K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C8018 lr=824AAFC8 K> F8000008 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C8018 prio=0 lr=824AAFC8 K> F8000008 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300CA018 lr=824AAFC8 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300CA018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC ExCreateThread entry=82506528 start_ctx=BCE251C0 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=824F7B24 i> F8000008 XThreadF8000154 (1B) Stack: 70880000-70890000 K> F8000008 AUDIT-HLC ExCreateThread entry=82506558 start_ctx=BCE251C0 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=824F7B24 i> F8000008 XThreadF8000158 (1C) Stack: 708B0000-708C0000 K> F8000008 AUDIT-HLC ExCreateThread entry=82506588 start_ctx=BCE251C0 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=824F7B24 i> F8000008 XThreadF800015C (1D) Stack: 708E0000-708F0000 K> F8000008 AUDIT-HLC ExCreateThread entry=825065B8 start_ctx=BCE251C0 xapi=824AFF88 flags=00000001 lr=824AC5F0 guest_lr=824F7B24 i> F8000008 XThreadF8000160 (1E) Stack: 70910000-70920000 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=00000000 prio=1 lr=824D09C4 K> F800006C AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=00000000 prio=1 lr=824D08C0 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=00000000 prio=1 lr=824D091C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC NtSetEvent handle=F8000034 lr=824AA304 guest_lr=82172DF4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000034 kevent_va=30045018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000064 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000034 result=00000000 lr=824AC578 guest_lr=822F1FC8 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000010 r5=828F3888 r6=701CF924 r7=00000000 r8=0000020E r9=00000010 r10=0000024C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: 00000000 00000001 30057018 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25284 lr=82507ABC K> F8000064 AUDIT-HLC silph_ctx_dump ctx_base=BCE251C0 (event BCE25284 at +C4) K> F8000064 AUDIT-HLC DUMP BCE251C0: 8200A1E8 BCE251C0 BCE251C0 00000001 K> F8000064 AUDIT-HLC DUMP BCE251D0: 01000000 00000000 3F7FCCCC 3F802D83 K> F8000064 AUDIT-HLC DUMP BCE251E0: 00000000 00000001 30057018 BCE254C0 K> F8000064 AUDIT-HLC DUMP BCE251F0: BE568F00 00000000 00000000 00000000 K> F8000064 AUDIT-HLC DUMP BCE25200: 00000000 00000000 00000000 00000000 K> F8000064 AUDIT-HLC DUMP BCE25210: 00000000 01000000 00000000 BCE2521C K> F8000064 AUDIT-HLC DUMP BCE25220: BCE2521C 01000000 00000000 BCE2522C K> F8000064 AUDIT-HLC DUMP BCE25230: BCE2522C 01000000 00000000 BCE2523C K> F8000064 AUDIT-HLC DUMP BCE25240: BCE2523C 01000000 00000000 BCE2524C K> F8000064 AUDIT-HLC DUMP BCE25250: BCE2524C 00000000 00000001 58454E00 K> F8000064 AUDIT-HLC DUMP BCE25260: F8000164 00000000 00000001 58454E00 K> F8000064 AUDIT-HLC DUMP BCE25270: F8000168 00000000 00000001 58454E00 K> F8000064 AUDIT-HLC DUMP BCE25280: F800016C 00000000 00000001 58454E00 K> F8000064 AUDIT-HLC DUMP BCE25290: F8000170 00000001 00000001 00000005 K> F8000064 AUDIT-HLC DUMP BCE252A0: 00000000 00000000 00000500 000002D0 K> F8000064 AUDIT-HLC DUMP BCE252B0: 00000001 00000000 00000000 00000000 K> F8000064 AUDIT-HLC DUMP BCE252C0: 00000000 00000000 F8000154 F8000158 K> F8000064 AUDIT-HLC DUMP BCE252D0: F800015C F8000160 3F800000 00000000 K> F8000064 AUDIT-HLC DUMP BCE252E0: 00000000 00000000 00000000 00000000 K> F8000064 AUDIT-HLC DUMP BCE252F0: 00000000 00000000 00000000 00000000 K> F8000064 AUDIT-HLC DUMP BCE25300: 00000000 00000000 00000000 00000000 K> F8000064 AUDIT-HLC DUMP BCE25310: 00000000 00000000 00000000 00000000 K> F8000064 AUDIT-HLC DUMP BCE25320: 00000000 00000000 00000000 00000000 K> F8000064 AUDIT-HLC DUMP BCE25330: 00000000 00000000 00000000 00000000 K> F8000064 AUDIT-HLC DUMP BCE25340: 820610E0 82061044 82061040 820610DC K> F8000064 AUDIT-HLC DUMP BCE25350: BCD24B1C BCD24B1C 8206116C 3F800000 K> F8000064 AUDIT-HLC DUMP BCE25360: 00000135 00000000 00000000 3F800000 K> F8000064 AUDIT-HLC DUMP BCE25370: B2CBA5DD BC97CC40 BCD24B00 00000000 K> F8000064 AUDIT-HLC DUMP BCE25380: 00000000 0000FFFF 00000000 BCE25440 K> F8000064 AUDIT-HLC DUMP BCE25390: BCE25394 00000000 00000000 00000000 K> F8000064 AUDIT-HLC DUMP BCE253A0: 00000000 00000064 BCE25398 FFFFFFFF K> F8000064 AUDIT-HLC DUMP BCE253B0: 00000135 BCE253A4 000000EB FFFFFFFF K> F8000064 AUDIT-HLC DUMP BCE253C0: BCE253B0 00000000 00000000 BCE253BC K> F8000064 AUDIT-HLC DUMP BCE253D0: 00000064 FFFFFFFF BCE253C8 0000014A K> F8000064 AUDIT-HLC DUMP BCE253E0: 000000EF BCE253D4 00000000 00000000 K> F8000064 AUDIT-HLC DUMP BCE253F0: BCE253E0 00000064 00000064 BCE253EC K> F8000064 AUDIT-HLC DUMP BCE25400: 00000135 0000014A BCE253F8 20FFFFFF K> F8000064 AUDIT-HLC DUMP BCE25410: 00000000 BCE25404 00000000 00000064 K> F8000064 AUDIT-HLC DUMP BCE25420: BCE25410 FFFFFFFF 00000135 BCE2541C K> F8000064 AUDIT-HLC DUMP BCE25430: 000000FF 00FFFFFF BCE25428 00000000 K> F8000064 AUDIT-HLC DUMP BCE25440: 00000000 BCE25434 00000064 BC97CC40 K> F8000064 AUDIT-HLC DUMP BCE25450: 00000000 00000000 BCE2544C BCE2544C K> F8000064 AUDIT-HLC DUMP BCE25460: 00000001 00000000 BCE24BC0 00000000 K> F8000064 AUDIT-HLC DUMP BCE25470: 00F10000 00000000 00000000 00000000 K> F8000064 AUDIT-HLC DUMP BCE25480: 00000001 82060B14 BCD25000 BCD25100 K> F8000064 AUDIT-HLC DUMP BCE25490: 00000000 02000000 BC22CB50 00000001 K> F8000064 AUDIT-HLC DUMP BCE254A0: 00000000 00000000 00000000 00000000 K> F8000064 AUDIT-HLC DUMP BCE254B0: 00000000 00000000 00000000 00000000 K> F8000064 AUDIT-HLC silph_ctx event-slots: K> F8000064 AUDIT-HLC slot[0] off=+54 addr=BCE25214 hdr=01000000 state=00000000 K> F8000064 AUDIT-HLC slot[1] off=+64 addr=BCE25224 hdr=01000000 state=00000000 K> F8000064 AUDIT-HLC slot[2] off=+74 addr=BCE25234 hdr=01000000 state=00000000 K> F8000064 AUDIT-HLC slot[3] off=+84 addr=BCE25244 hdr=01000000 state=00000000 K> F8000064 AUDIT-HLC slot[4] off=+94 addr=BCE25254 hdr=00000000 state=00000001 K> F8000064 AUDIT-HLC slot[5] off=+A4 addr=BCE25264 hdr=00000000 state=00000001 K> F8000064 AUDIT-HLC slot[6] off=+B4 addr=BCE25274 hdr=00000000 state=00000001 K> F8000064 AUDIT-HLC slot[7] off=+C4 addr=BCE25284 hdr=00000000 state=00000001 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000170 kevent_va=00000000 prio=1 lr=82507ABC K> F8000154 XThread::Execute thid 27 (handle=F8000154, 'XThread021C (F8000154)', native=0000021C) K> F8000154 AUDIT-HLC XThread::Execute tid=27 start_address=82506528 start_context=BCE251C0 xapi=824AFF88 K> F8000158 XThread::Execute thid 28 (handle=F8000158, 'XThread0220 (F8000158)', native=00000220) K> F8000158 AUDIT-HLC XThread::Execute tid=28 start_address=82506558 start_context=BCE251C0 xapi=824AFF88 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BC018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BC018 prio=0 lr=824AAFC8 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000138 kevent_va=300BE018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000138 kevent_va=300BE018 prio=0 lr=824AAFC8 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300C0018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300C0018 prio=0 lr=824AAFC8 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300C2018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300C2018 prio=0 lr=824AAFC8 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=0000000C r5=828F3888 r6=701CF924 r7=03A72328 r8=0000020F r9=00000010 r10=00000259 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800015C XThread::Execute thid 29 (handle=F800015C, 'XThread0224 (F800015C)', native=00000224) K> F800015C AUDIT-HLC XThread::Execute tid=29 start_address=82506588 start_context=BCE251C0 xapi=824AFF88 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000006 r8=00000210 r9=00000010 r10=0000025A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000211 r9=00000010 r10=0000025B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: 00000000 00000001 30057018 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000002 r5=828F3888 r6=701CF924 r7=00000000 r8=00000212 r9=00000010 r10=0000025E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000002 r8=00000213 r9=00000010 r10=0000025F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000214 r9=00000010 r10=00000260 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: 00000000 00000001 30057018 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C4018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C4018 prio=0 lr=824AAFC8 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000215 r9=00000010 r10=00000261 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=3007E018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=3007E018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000216 r9=00000010 r10=00000262 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000217 r9=00000010 r10=00000263 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000218 r9=00000010 r10=00000264 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000219 r9=00000010 r10=00000265 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000021A r9=00000010 r10=00000266 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000021B r9=00000010 r10=00000267 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000021C r9=00000010 r10=00000268 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000021D r9=00000010 r10=00000269 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000021E r9=00000010 r10=0000026A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000021F r9=00000010 r10=0000026B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000220 r9=00000010 r10=0000026C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000221 r9=00000010 r10=0000026D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000222 r9=00000010 r10=0000026E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000223 r9=00000010 r10=0000026F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000224 r9=00000010 r10=00000270 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000225 r9=00000010 r10=00000271 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000226 r9=00000010 r10=00000272 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C6018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C6018 prio=0 lr=824AAFC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000227 r9=00000010 r10=00000273 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000228 r9=00000010 r10=00000274 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000229 r9=00000010 r10=00000275 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000022A r9=00000010 r10=00000276 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000022B r9=00000010 r10=00000277 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000022C r9=00000010 r10=00000278 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000022D r9=00000010 r10=00000279 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000022E r9=00000010 r10=0000027A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000022F r9=00000010 r10=0000027B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000230 r9=00000010 r10=0000027C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000231 r9=00000010 r10=0000027D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000232 r9=00000010 r10=0000027E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000233 r9=00000010 r10=0000027F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000234 r9=00000010 r10=00000280 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000235 r9=00000010 r10=00000281 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000236 r9=00000010 r10=00000282 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000237 r9=00000010 r10=00000283 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000238 r9=00000010 r10=00000284 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000239 r9=00000010 r10=00000285 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000023A r9=00000010 r10=00000286 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000023B r9=00000010 r10=00000287 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC XEvent::Set handle=F80000C8 kevent_va=00000000 prio=1 lr=827E843C K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000023C r9=00000010 r10=00000288 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000023D r9=00000010 r10=00000289 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000023E r9=00000010 r10=0000028A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C8018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C8018 prio=0 lr=824AAFC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000023F r9=00000010 r10=0000028B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000240 r9=00000010 r10=0000028C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000241 r9=00000010 r10=0000028D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000242 r9=00000010 r10=0000028E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000243 r9=00000010 r10=0000028F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000244 r9=00000010 r10=00000290 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000245 r9=00000010 r10=00000291 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000246 r9=00000010 r10=00000292 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000247 r9=00000010 r10=00000293 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000248 r9=00000010 r10=00000294 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000249 r9=00000010 r10=00000295 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000024A r9=00000010 r10=00000296 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300CA018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300CA018 prio=0 lr=824AAFC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000024B r9=00000010 r10=00000297 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000024C r9=00000010 r10=00000298 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000024D r9=00000010 r10=00000299 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000024E r9=00000010 r10=0000029A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000024F r9=00000010 r10=0000029B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000250 r9=00000010 r10=0000029C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000251 r9=00000010 r10=0000029D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000252 r9=00000010 r10=0000029E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000114 kevent_va=30080018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F8000114 kevent_va=30080018 prio=0 lr=824AAFC8 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000253 r9=00000010 r10=0000029F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000254 r9=00000010 r10=000002A0 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000255 r9=00000010 r10=000002A1 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000256 r9=00000010 r10=000002A2 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000257 r9=00000010 r10=000002A3 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000258 r9=00000010 r10=000002A4 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000259 r9=00000010 r10=000002A5 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000025A r9=00000010 r10=000002A6 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000025B r9=00000010 r10=000002A7 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000025C r9=00000010 r10=000002A8 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000025D r9=00000010 r10=000002A9 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000025E r9=00000010 r10=000002AA lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000025F r9=00000010 r10=000002AB lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000260 r9=00000010 r10=000002AC lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000261 r9=00000010 r10=000002AD lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000262 r9=00000010 r10=000002AE lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000263 r9=00000010 r10=000002AF lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000264 r9=00000010 r10=000002B0 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000265 r9=00000010 r10=000002B1 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000266 r9=00000010 r10=000002B2 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000267 r9=00000010 r10=000002B3 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000268 r9=00000010 r10=000002B4 lr=822F1D5C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000269 r9=00000010 r10=000002B5 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000026A r9=00000010 r10=000002B6 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000026B r9=00000010 r10=000002B7 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000026C r9=00000010 r10=000002B8 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BC018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BC018 prio=0 lr=824AAFC8 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000026D r9=00000010 r10=000002B9 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000026E r9=00000010 r10=000002BA lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000026F r9=00000010 r10=000002BB lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000270 r9=00000010 r10=000002BC lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000271 r9=00000010 r10=000002BD lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000272 r9=00000010 r10=000002BE lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000273 r9=00000010 r10=000002BF lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000274 r9=00000010 r10=000002C0 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000275 r9=00000010 r10=000002C1 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000276 r9=00000010 r10=000002C2 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000277 r9=00000010 r10=000002C3 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000278 r9=00000010 r10=000002C4 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000279 r9=00000010 r10=000002C5 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000027A r9=00000010 r10=000002C6 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000027B r9=00000010 r10=000002C7 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000027C r9=00000010 r10=000002C8 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000027D r9=00000010 r10=000002C9 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000027E r9=00000010 r10=000002CA lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000027F r9=00000010 r10=000002CB lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000280 r9=00000010 r10=000002CC lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000281 r9=00000010 r10=000002CD lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000282 r9=00000010 r10=000002CE lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000283 r9=00000010 r10=000002CF lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000284 r9=00000010 r10=000002D0 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000285 r9=00000010 r10=000002D1 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000286 r9=00000010 r10=000002D2 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000138 kevent_va=300BE018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000138 kevent_va=300BE018 prio=0 lr=824AAFC8 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000287 r9=00000010 r10=000002D3 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000288 r9=00000010 r10=000002D4 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000289 r9=00000010 r10=000002D5 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000028A r9=00000010 r10=000002D6 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000028B r9=00000010 r10=000002D7 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000028C r9=00000010 r10=000002D8 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000028D r9=00000010 r10=000002D9 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000028E r9=00000010 r10=000002DA lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000028F r9=00000010 r10=000002DB lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000290 r9=00000010 r10=000002DC lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000291 r9=00000010 r10=000002DD lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000292 r9=00000010 r10=000002DE lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000293 r9=00000010 r10=000002DF lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000294 r9=00000010 r10=000002E0 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000295 r9=00000010 r10=000002E1 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000296 r9=00000010 r10=000002E2 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000297 r9=00000010 r10=000002E3 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000298 r9=00000010 r10=000002E4 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000299 r9=00000010 r10=000002E5 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000029A r9=00000010 r10=000002E6 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000029B r9=00000010 r10=000002E7 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=300B0018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=300B0018 prio=0 lr=824AAFC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000029C r9=00000010 r10=000002E8 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000029D r9=00000010 r10=000002E9 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000029E r9=00000010 r10=000002EA lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000029F r9=00000010 r10=000002EB lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002A0 r9=00000010 r10=000002EC lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300C0018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300C0018 prio=0 lr=824AAFC8 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002A1 r9=00000010 r10=000002ED lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002A2 r9=00000010 r10=000002EE lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002A3 r9=00000010 r10=000002EF lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002A4 r9=00000010 r10=000002F0 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002A5 r9=00000010 r10=000002F1 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002A6 r9=00000010 r10=000002F2 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002A7 r9=00000010 r10=000002F3 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002A8 r9=00000010 r10=000002F4 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002A9 r9=00000010 r10=000002F5 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002AA r9=00000010 r10=000002F6 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002AB r9=00000010 r10=000002F7 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002AC r9=00000010 r10=000002F8 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002AD r9=00000010 r10=000002F9 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002AE r9=00000010 r10=000002FA lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002AF r9=00000010 r10=000002FB lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002B0 r9=00000010 r10=000002FC lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002B1 r9=00000010 r10=000002FD lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002B2 r9=00000010 r10=000002FE lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002B3 r9=00000010 r10=000002FF lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002B4 r9=00000010 r10=00000300 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002B5 r9=00000010 r10=00000301 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002B6 r9=00000010 r10=00000302 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002B7 r9=00000010 r10=00000303 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002B8 r9=00000010 r10=00000304 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002B9 r9=00000010 r10=00000305 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002BA r9=00000010 r10=00000306 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300C2018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300C2018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002BB r9=00000010 r10=00000307 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002BC r9=00000010 r10=00000308 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002BD r9=00000010 r10=00000309 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002BE r9=00000010 r10=0000030A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002BF r9=00000010 r10=0000030B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002C0 r9=00000010 r10=0000030C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002C1 r9=00000010 r10=0000030D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002C2 r9=00000010 r10=0000030E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002C3 r9=00000010 r10=0000030F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002C4 r9=00000010 r10=00000310 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002C5 r9=00000010 r10=00000311 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002C6 r9=00000010 r10=00000312 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002C7 r9=00000010 r10=00000313 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002C8 r9=00000010 r10=00000314 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002C9 r9=00000010 r10=00000315 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002CA r9=00000010 r10=00000316 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002CB r9=00000010 r10=00000317 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002CC r9=00000010 r10=00000318 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002CD r9=00000010 r10=00000319 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002CE r9=00000010 r10=0000031A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002CF r9=00000010 r10=0000031B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002D0 r9=00000010 r10=0000031C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002D1 r9=00000010 r10=0000031D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002D2 r9=00000010 r10=0000031E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002D3 r9=00000010 r10=0000031F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002D4 r9=00000010 r10=00000320 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C4018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C4018 prio=0 lr=824AAFC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002D5 r9=00000010 r10=00000321 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002D6 r9=00000010 r10=00000322 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002D7 r9=00000010 r10=00000323 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002D8 r9=00000010 r10=00000324 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002D9 r9=00000010 r10=00000325 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002DA r9=00000010 r10=00000326 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002DB r9=00000010 r10=00000327 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002DC r9=00000010 r10=00000328 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002DD r9=00000010 r10=00000329 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002DE r9=00000010 r10=0000032A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002DF r9=00000010 r10=0000032B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002E0 r9=00000010 r10=0000032C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002E1 r9=00000010 r10=0000032D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002E2 r9=00000010 r10=0000032E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002E3 r9=00000010 r10=0000032F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002E4 r9=00000010 r10=00000330 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002E5 r9=00000010 r10=00000331 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002E6 r9=00000010 r10=00000332 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002E7 r9=00000010 r10=00000333 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002E8 r9=00000010 r10=00000334 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002E9 r9=00000010 r10=00000335 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002EA r9=00000010 r10=00000336 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002EB r9=00000010 r10=00000337 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002EC r9=00000010 r10=00000338 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C6018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C6018 prio=0 lr=824AAFC8 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002ED r9=00000010 r10=00000339 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002EE r9=00000010 r10=0000033A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002EF r9=00000010 r10=0000033B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F800011C kevent_va=300B2018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F800011C kevent_va=300B2018 prio=0 lr=824AAFC8 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002F0 r9=00000010 r10=0000033C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002F1 r9=00000010 r10=0000033D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002F2 r9=00000010 r10=0000033E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002F3 r9=00000010 r10=0000033F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002F4 r9=00000010 r10=00000340 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002F5 r9=00000010 r10=00000341 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002F6 r9=00000010 r10=00000342 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002F7 r9=00000010 r10=00000343 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002F8 r9=00000010 r10=00000344 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002F9 r9=00000010 r10=00000345 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002FA r9=00000010 r10=00000346 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002FB r9=00000010 r10=00000347 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002FC r9=00000010 r10=00000348 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002FD r9=00000010 r10=00000349 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000002FE r9=00000010 r10=0000034A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000002FF r9=00000010 r10=0000034B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000300 r9=00000010 r10=0000034C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C8018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C8018 prio=0 lr=824AAFC8 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000301 r9=00000010 r10=0000034D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000302 r9=00000010 r10=0000034E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000303 r9=00000010 r10=0000034F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000304 r9=00000010 r10=00000350 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000305 r9=00000010 r10=00000351 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000306 r9=00000010 r10=00000352 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000307 r9=00000010 r10=00000353 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000308 r9=00000010 r10=00000354 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000309 r9=00000010 r10=00000355 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000030A r9=00000010 r10=00000356 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000030B r9=00000010 r10=00000357 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000030C r9=00000010 r10=00000358 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000030D r9=00000010 r10=00000359 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000030E r9=00000010 r10=0000035A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000030F r9=00000010 r10=0000035B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000310 r9=00000010 r10=0000035C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000311 r9=00000010 r10=0000035D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000312 r9=00000010 r10=0000035E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000313 r9=00000010 r10=0000035F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000314 r9=00000010 r10=00000360 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300CA018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300CA018 prio=0 lr=824AAFC8 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000315 r9=00000010 r10=00000361 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000316 r9=00000010 r10=00000362 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000317 r9=00000010 r10=00000363 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000318 r9=00000010 r10=00000364 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000319 r9=00000010 r10=00000365 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000031A r9=00000010 r10=00000366 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000031B r9=00000010 r10=00000367 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000031C r9=00000010 r10=00000368 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=00000000 prio=1 lr=824D08C0 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000031D r9=00000010 r10=00000369 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000031E r9=00000010 r10=0000036A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000031F r9=00000010 r10=0000036B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000320 r9=00000010 r10=0000036C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000321 r9=00000010 r10=0000036D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000322 r9=00000010 r10=0000036E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000323 r9=00000010 r10=0000036F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B4018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B4018 prio=0 lr=824AAFC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000324 r9=00000010 r10=00000370 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000325 r9=00000010 r10=00000371 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000326 r9=00000010 r10=00000372 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000327 r9=00000010 r10=00000373 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000328 r9=00000010 r10=00000374 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000329 r9=00000010 r10=00000375 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000032A r9=00000010 r10=00000376 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BC018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BC018 prio=0 lr=824AAFC8 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000032B r9=00000010 r10=00000377 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000032C r9=00000010 r10=00000378 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000032D r9=00000010 r10=00000379 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000032E r9=00000010 r10=0000037A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000032F r9=00000010 r10=0000037B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000330 r9=00000010 r10=0000037C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000331 r9=00000010 r10=0000037D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000332 r9=00000010 r10=0000037E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000333 r9=00000010 r10=0000037F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000334 r9=00000010 r10=00000380 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000335 r9=00000010 r10=00000381 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B6018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B6018 prio=0 lr=824AAFC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000336 r9=00000010 r10=00000382 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000337 r9=00000010 r10=00000383 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000338 r9=00000010 r10=00000384 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000339 r9=00000010 r10=00000385 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000033A r9=00000010 r10=00000386 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=00000000 prio=1 lr=824D0868 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000033B r9=00000010 r10=00000387 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000033C r9=00000010 r10=00000388 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000033D r9=00000010 r10=00000389 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000033E r9=00000010 r10=0000038A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000138 kevent_va=300BE018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000138 kevent_va=300BE018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000033F r9=00000010 r10=0000038B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000340 r9=00000010 r10=0000038C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000341 r9=00000010 r10=0000038D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000342 r9=00000010 r10=0000038E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000343 r9=00000010 r10=0000038F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000344 r9=00000010 r10=00000390 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000345 r9=00000010 r10=00000391 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000346 r9=00000010 r10=00000392 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000347 r9=00000010 r10=00000393 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000348 r9=00000010 r10=00000394 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000349 r9=00000010 r10=00000395 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000034A r9=00000010 r10=00000396 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000034B r9=00000010 r10=00000397 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000034C r9=00000010 r10=00000398 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000034D r9=00000010 r10=00000399 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000034E r9=00000010 r10=0000039A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000034F r9=00000010 r10=0000039B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000350 r9=00000010 r10=0000039C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000351 r9=00000010 r10=0000039D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000352 r9=00000010 r10=0000039E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000353 r9=00000010 r10=0000039F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000354 r9=00000010 r10=000003A0 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300C0018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300C0018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000355 r9=00000010 r10=000003A1 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000356 r9=00000010 r10=000003A2 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000357 r9=00000010 r10=000003A3 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000358 r9=00000010 r10=000003A4 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000359 r9=00000010 r10=000003A5 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B8018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B8018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F800012C kevent_va=300BA018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F800012C kevent_va=300BA018 prio=0 lr=824AAFC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000035A r9=00000010 r10=000003A6 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000035B r9=00000010 r10=000003A7 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000035C r9=00000010 r10=000003A8 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000035D r9=00000010 r10=000003A9 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000035E r9=00000010 r10=000003AA lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300C2018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300C2018 prio=0 lr=824AAFC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000035F r9=00000010 r10=000003AB lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000360 r9=00000010 r10=000003AC lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000361 r9=00000010 r10=000003AD lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000362 r9=00000010 r10=000003AE lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000363 r9=00000010 r10=000003AF lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000364 r9=00000010 r10=000003B0 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000365 r9=00000010 r10=000003B1 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000366 r9=00000010 r10=000003B2 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000367 r9=00000010 r10=000003B3 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=00000000 prio=1 lr=824D08C0 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000368 r9=00000010 r10=000003B4 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000369 r9=00000010 r10=000003B5 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000036A r9=00000010 r10=000003B6 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000036B r9=00000010 r10=000003B7 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000036C r9=00000010 r10=000003B8 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C4018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C4018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000036D r9=00000010 r10=000003B9 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000036E r9=00000010 r10=000003BA lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000036F r9=00000010 r10=000003BB lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000370 r9=00000010 r10=000003BC lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000371 r9=00000010 r10=000003BD lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000372 r9=00000010 r10=000003BE lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000373 r9=00000010 r10=000003BF lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000374 r9=00000010 r10=000003C0 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000375 r9=00000010 r10=000003C1 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000376 r9=00000010 r10=000003C2 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000377 r9=00000010 r10=000003C3 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000378 r9=00000010 r10=000003C4 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000379 r9=00000010 r10=000003C5 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000037A r9=00000010 r10=000003C6 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C6018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C6018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000037B r9=00000010 r10=000003C7 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000037C r9=00000010 r10=000003C8 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000037D r9=00000010 r10=000003C9 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000037E r9=00000010 r10=000003CA lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000037F r9=00000010 r10=000003CB lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000380 r9=00000010 r10=000003CC lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000381 r9=00000010 r10=000003CD lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000382 r9=00000010 r10=000003CE lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC XEvent::Set handle=F80000C8 kevent_va=00000000 prio=1 lr=827E843C K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=3007E018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000383 r9=00000010 r10=000003CF lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000384 r9=00000010 r10=000003D0 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000385 r9=00000010 r10=000003D1 lr=822F1D5C K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000386 r9=00000010 r10=000003D2 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000387 r9=00000010 r10=000003D3 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000388 r9=00000010 r10=000003D4 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C8018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C8018 prio=0 lr=824AAFC8 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000389 r9=00000010 r10=000003D5 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000038A r9=00000010 r10=000003D6 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000038B r9=00000010 r10=000003D7 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000038C r9=00000010 r10=000003D8 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000038D r9=00000010 r10=000003D9 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000038E r9=00000010 r10=000003DA lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000038F r9=00000010 r10=000003DB lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000390 r9=00000010 r10=000003DC lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000391 r9=00000010 r10=000003DD lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000392 r9=00000010 r10=000003DE lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000393 r9=00000010 r10=000003DF lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000114 kevent_va=30080018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F8000114 kevent_va=30080018 prio=0 lr=824AAFC8 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000394 r9=00000010 r10=000003E0 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000395 r9=00000010 r10=000003E1 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000396 r9=00000010 r10=000003E2 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300CA018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300CA018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000397 r9=00000010 r10=000003E3 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000398 r9=00000010 r10=000003E4 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000399 r9=00000010 r10=000003E5 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000039A r9=00000010 r10=000003E6 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000039B r9=00000010 r10=000003E7 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000039C r9=00000010 r10=000003E8 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000039D r9=00000010 r10=000003E9 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000039E r9=00000010 r10=000003EA lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000039F r9=00000010 r10=000003EB lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003A0 r9=00000010 r10=000003EC lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003A1 r9=00000010 r10=000003ED lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003A2 r9=00000010 r10=000003EE lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003A3 r9=00000010 r10=000003EF lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003A4 r9=00000010 r10=000003F0 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BC018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BC018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003A5 r9=00000010 r10=000003F1 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=300B0018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=300B0018 prio=0 lr=824AAFC8 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003A6 r9=00000010 r10=000003F2 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003A7 r9=00000010 r10=000003F3 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003A8 r9=00000010 r10=000003F4 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003A9 r9=00000010 r10=000003F5 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC XEvent::Set handle=F80000C8 kevent_va=00000000 prio=1 lr=827E9C9C K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003AA r9=00000010 r10=000003F6 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003AB r9=00000010 r10=000003F7 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003AC r9=00000010 r10=000003F8 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003AD r9=00000010 r10=000003F9 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003AE r9=00000010 r10=000003FA lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003AF r9=00000010 r10=000003FB lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003B0 r9=00000010 r10=000003FC lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003B1 r9=00000010 r10=000003FD lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003B2 r9=00000010 r10=000003FE lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000138 kevent_va=300BE018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000138 kevent_va=300BE018 prio=0 lr=824AAFC8 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003B3 r9=00000010 r10=000003FF lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003B4 r9=00000010 r10=00000400 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003B5 r9=00000010 r10=00000401 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003B6 r9=00000010 r10=00000402 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003B7 r9=00000010 r10=00000403 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003B8 r9=00000010 r10=00000404 lr=822F1D5C K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003B9 r9=00000010 r10=00000405 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003BA r9=00000010 r10=00000406 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003BB r9=00000010 r10=00000407 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003BC r9=00000010 r10=00000408 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003BD r9=00000010 r10=00000409 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003BE r9=00000010 r10=0000040A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003BF r9=00000010 r10=0000040B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003C0 r9=00000010 r10=0000040C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300C0018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300C0018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003C1 r9=00000010 r10=0000040D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003C2 r9=00000010 r10=0000040E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003C3 r9=00000010 r10=0000040F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003C4 r9=00000010 r10=00000410 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003C5 r9=00000010 r10=00000411 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003C6 r9=00000010 r10=00000412 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003C7 r9=00000010 r10=00000413 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003C8 r9=00000010 r10=00000414 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003C9 r9=00000010 r10=00000415 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003CA r9=00000010 r10=00000416 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003CB r9=00000010 r10=00000417 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F800011C kevent_va=300B2018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F800011C kevent_va=300B2018 prio=0 lr=824AAFC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003CC r9=00000010 r10=00000418 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003CD r9=00000010 r10=00000419 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003CE r9=00000010 r10=0000041A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300C2018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300C2018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003CF r9=00000010 r10=0000041B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003D0 r9=00000010 r10=0000041C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003D1 r9=00000010 r10=0000041D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003D2 r9=00000010 r10=0000041E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003D3 r9=00000010 r10=0000041F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003D4 r9=00000010 r10=00000420 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003D5 r9=00000010 r10=00000421 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003D6 r9=00000010 r10=00000422 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003D7 r9=00000010 r10=00000423 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003D8 r9=00000010 r10=00000424 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003D9 r9=00000010 r10=00000425 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003DA r9=00000010 r10=00000426 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003DB r9=00000010 r10=00000427 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003DC r9=00000010 r10=00000428 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003DD r9=00000010 r10=00000429 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B4018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B4018 prio=0 lr=824AAFC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003DE r9=00000010 r10=0000042A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C4018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C4018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003DF r9=00000010 r10=0000042B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003E0 r9=00000010 r10=0000042C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003E1 r9=00000010 r10=0000042D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003E2 r9=00000010 r10=0000042E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003E3 r9=00000010 r10=0000042F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003E4 r9=00000010 r10=00000430 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003E5 r9=00000010 r10=00000431 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003E6 r9=00000010 r10=00000432 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003E7 r9=00000010 r10=00000433 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003E8 r9=00000010 r10=00000434 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003E9 r9=00000010 r10=00000435 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003EA r9=00000010 r10=00000436 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C6018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C6018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003EB r9=00000010 r10=00000437 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003EC r9=00000010 r10=00000438 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003ED r9=00000010 r10=00000439 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B6018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B6018 prio=0 lr=824AAFC8 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003EE r9=00000010 r10=0000043A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003EF r9=00000010 r10=0000043B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003F0 r9=00000010 r10=0000043C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003F1 r9=00000010 r10=0000043D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003F2 r9=00000010 r10=0000043E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003F3 r9=00000010 r10=0000043F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003F4 r9=00000010 r10=00000440 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003F5 r9=00000010 r10=00000441 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003F6 r9=00000010 r10=00000442 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C8018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C8018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003F7 r9=00000010 r10=00000443 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003F8 r9=00000010 r10=00000444 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003F9 r9=00000010 r10=00000445 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003FA r9=00000010 r10=00000446 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003FB r9=00000010 r10=00000447 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003FC r9=00000010 r10=00000448 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003FD r9=00000010 r10=00000449 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000003FE r9=00000010 r10=0000044A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000003FF r9=00000010 r10=0000044B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000400 r9=00000010 r10=0000044C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B8018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B8018 prio=0 lr=824AAFC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000401 r9=00000010 r10=0000044D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000402 r9=00000010 r10=0000044E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000403 r9=00000010 r10=0000044F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000404 r9=00000010 r10=00000450 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000405 r9=00000010 r10=00000451 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000406 r9=00000010 r10=00000452 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300CA018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300CA018 prio=0 lr=824AAFC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000407 r9=00000010 r10=00000453 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000408 r9=00000010 r10=00000454 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000409 r9=00000010 r10=00000455 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000040A r9=00000010 r10=00000456 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000040B r9=00000010 r10=00000457 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000040C r9=00000010 r10=00000458 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=00000000 prio=1 lr=824D08C0 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000040D r9=00000010 r10=00000459 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000040E r9=00000010 r10=0000045A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000040F r9=00000010 r10=0000045B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000410 r9=00000010 r10=0000045C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BC018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BC018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000411 r9=00000010 r10=0000045D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000412 r9=00000010 r10=0000045E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000413 r9=00000010 r10=0000045F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F800012C kevent_va=300BA018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F800012C kevent_va=300BA018 prio=0 lr=824AAFC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000414 r9=00000010 r10=00000460 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000415 r9=00000010 r10=00000461 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000416 r9=00000010 r10=00000462 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000417 r9=00000010 r10=00000463 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000418 r9=00000010 r10=00000464 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000419 r9=00000010 r10=00000465 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000041A r9=00000010 r10=00000466 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000041B r9=00000010 r10=00000467 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000041C r9=00000010 r10=00000468 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000041D r9=00000010 r10=00000469 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000041E r9=00000010 r10=0000046A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000138 kevent_va=300BE018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000138 kevent_va=300BE018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000041F r9=00000010 r10=0000046B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000420 r9=00000010 r10=0000046C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000421 r9=00000010 r10=0000046D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000422 r9=00000010 r10=0000046E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000423 r9=00000010 r10=0000046F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000424 r9=00000010 r10=00000470 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000425 r9=00000010 r10=00000471 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=3007E018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000426 r9=00000010 r10=00000472 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000427 r9=00000010 r10=00000473 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000428 r9=00000010 r10=00000474 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000429 r9=00000010 r10=00000475 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000042A r9=00000010 r10=00000476 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000042B r9=00000010 r10=00000477 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000042C r9=00000010 r10=00000478 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000042D r9=00000010 r10=00000479 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000042E r9=00000010 r10=0000047A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000042F r9=00000010 r10=0000047B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000430 r9=00000010 r10=0000047C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300C0018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300C0018 prio=0 lr=824AAFC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000431 r9=00000010 r10=0000047D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000432 r9=00000010 r10=0000047E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000433 r9=00000010 r10=0000047F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000434 r9=00000010 r10=00000480 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000435 r9=00000010 r10=00000481 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000436 r9=00000010 r10=00000482 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000437 r9=00000010 r10=00000483 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000438 r9=00000010 r10=00000484 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000439 r9=00000010 r10=00000485 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000114 kevent_va=30080018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F8000114 kevent_va=30080018 prio=0 lr=824AAFC8 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000043A r9=00000010 r10=00000486 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000043B r9=00000010 r10=00000487 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000043C r9=00000010 r10=00000488 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000043D r9=00000010 r10=00000489 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000043E r9=00000010 r10=0000048A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000043F r9=00000010 r10=0000048B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC XEvent::Set handle=F80000C8 kevent_va=00000000 prio=1 lr=827E843C K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000440 r9=00000010 r10=0000048C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000441 r9=00000010 r10=0000048D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000442 r9=00000010 r10=0000048E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000443 r9=00000010 r10=0000048F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000444 r9=00000010 r10=00000490 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000445 r9=00000010 r10=00000491 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000446 r9=00000010 r10=00000492 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000447 r9=00000010 r10=00000493 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000448 r9=00000010 r10=00000494 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000449 r9=00000010 r10=00000495 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000044A r9=00000010 r10=00000496 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000044B r9=00000010 r10=00000497 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000044C r9=00000010 r10=00000498 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000044D r9=00000010 r10=00000499 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000044E r9=00000010 r10=0000049A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000044F r9=00000010 r10=0000049B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=300B0018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=300B0018 prio=0 lr=824AAFC8 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000450 r9=00000010 r10=0000049C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000451 r9=00000010 r10=0000049D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000452 r9=00000010 r10=0000049E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000453 r9=00000010 r10=0000049F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000454 r9=00000010 r10=000004A0 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000455 r9=00000010 r10=000004A1 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000456 r9=00000010 r10=000004A2 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000457 r9=00000010 r10=000004A3 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000458 r9=00000010 r10=000004A4 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000459 r9=00000010 r10=000004A5 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000045A r9=00000010 r10=000004A6 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000084 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=00000000 prio=1 lr=824D08C0 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000045B r9=00000010 r10=000004A7 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000045C r9=00000010 r10=000004A8 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000045D r9=00000010 r10=000004A9 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000045E r9=00000010 r10=000004AA lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000045F r9=00000010 r10=000004AB lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000460 r9=00000010 r10=000004AC lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000461 r9=00000010 r10=000004AD lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000462 r9=00000010 r10=000004AE lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000463 r9=00000010 r10=000004AF lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000464 r9=00000010 r10=000004B0 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000465 r9=00000010 r10=000004B1 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F800011C kevent_va=300B2018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F800011C kevent_va=300B2018 prio=0 lr=824AAFC8 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000466 r9=00000010 r10=000004B2 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000467 r9=00000010 r10=000004B3 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000468 r9=00000010 r10=000004B4 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000469 r9=00000010 r10=000004B5 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000046A r9=00000010 r10=000004B6 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000046B r9=00000010 r10=000004B7 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000046C r9=00000010 r10=000004B8 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000046D r9=00000010 r10=000004B9 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000046E r9=00000010 r10=000004BA lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000046F r9=00000010 r10=000004BB lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000470 r9=00000010 r10=000004BC lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000471 r9=00000010 r10=000004BD lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000472 r9=00000010 r10=000004BE lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000473 r9=00000010 r10=000004BF lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000474 r9=00000010 r10=000004C0 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300C2018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300C2018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000475 r9=00000010 r10=000004C1 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000476 r9=00000010 r10=000004C2 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000477 r9=00000010 r10=000004C3 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000478 r9=00000010 r10=000004C4 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC XEvent::Set handle=F80000C8 kevent_va=00000000 prio=1 lr=827E843C K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000479 r9=00000010 r10=000004C5 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000047A r9=00000010 r10=000004C6 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000047B r9=00000010 r10=000004C7 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000047C r9=00000010 r10=000004C8 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000047D r9=00000010 r10=000004C9 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B4018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B4018 prio=0 lr=824AAFC8 K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B6018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B6018 prio=0 lr=824AAFC8 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000047E r9=00000010 r10=000004CA lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000047F r9=00000010 r10=000004CB lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000480 r9=00000010 r10=000004CC lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000481 r9=00000010 r10=000004CD lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000482 r9=00000010 r10=000004CE lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000483 r9=00000010 r10=000004CF lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000484 r9=00000010 r10=000004D0 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC XEvent::Set handle=F80000C8 kevent_va=00000000 prio=1 lr=827E843C K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C4018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C4018 prio=0 lr=824AAFC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000485 r9=00000010 r10=000004D1 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000486 r9=00000010 r10=000004D2 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000487 r9=00000010 r10=000004D3 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000488 r9=00000010 r10=000004D4 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000489 r9=00000010 r10=000004D5 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000048A r9=00000010 r10=000004D6 lr=822F1D5C K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000048B r9=00000010 r10=000004D7 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000048C r9=00000010 r10=000004D8 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000048D r9=00000010 r10=000004D9 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000048E r9=00000010 r10=000004DA lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C6018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C6018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000048F r9=00000010 r10=000004DB lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000490 r9=00000010 r10=000004DC lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000491 r9=00000010 r10=000004DD lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000492 r9=00000010 r10=000004DE lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000493 r9=00000010 r10=000004DF lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B8018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B8018 prio=0 lr=824AAFC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000494 r9=00000010 r10=000004E0 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000495 r9=00000010 r10=000004E1 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000496 r9=00000010 r10=000004E2 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000497 r9=00000010 r10=000004E3 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000498 r9=00000010 r10=000004E4 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000499 r9=00000010 r10=000004E5 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000049A r9=00000010 r10=000004E6 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C8018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C8018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000049B r9=00000010 r10=000004E7 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000049C r9=00000010 r10=000004E8 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000049D r9=00000010 r10=000004E9 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000049E r9=00000010 r10=000004EA lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000049F r9=00000010 r10=000004EB lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004A0 r9=00000010 r10=000004EC lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004A1 r9=00000010 r10=000004ED lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004A2 r9=00000010 r10=000004EE lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004A3 r9=00000010 r10=000004EF lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004A4 r9=00000010 r10=000004F0 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300CA018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300CA018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004A5 r9=00000010 r10=000004F1 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F800012C kevent_va=300BA018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F800012C kevent_va=300BA018 prio=0 lr=824AAFC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=3007E018 lr=824AAFC8 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=3007E018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004A6 r9=00000010 r10=000004F2 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004A7 r9=00000010 r10=000004F3 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004A8 r9=00000010 r10=000004F4 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004A9 r9=00000010 r10=000004F5 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004AA r9=00000010 r10=000004F6 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004AB r9=00000010 r10=000004F7 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004AC r9=00000010 r10=000004F8 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BC018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BC018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004AD r9=00000010 r10=000004F9 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004AE r9=00000010 r10=000004FA lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004AF r9=00000010 r10=000004FB lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004B0 r9=00000010 r10=000004FC lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004B1 r9=00000010 r10=000004FD lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004B2 r9=00000010 r10=000004FE lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004B3 r9=00000010 r10=000004FF lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004B4 r9=00000010 r10=00000500 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004B5 r9=00000010 r10=00000501 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004B6 r9=00000010 r10=00000502 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000138 kevent_va=300BE018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000138 kevent_va=300BE018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004B7 r9=00000010 r10=00000503 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004B8 r9=00000010 r10=00000504 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004B9 r9=00000010 r10=00000505 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004BA r9=00000010 r10=00000506 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000114 kevent_va=30080018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F8000114 kevent_va=30080018 prio=0 lr=824AAFC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004BB r9=00000010 r10=00000507 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004BC r9=00000010 r10=00000508 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004BD r9=00000010 r10=00000509 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=00000000 prio=1 lr=824D08C0 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004BE r9=00000010 r10=0000050A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300C0018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300C0018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004BF r9=00000010 r10=0000050B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004C0 r9=00000010 r10=0000050C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004C1 r9=00000010 r10=0000050D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004C2 r9=00000010 r10=0000050E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004C3 r9=00000010 r10=0000050F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004C4 r9=00000010 r10=00000510 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004C5 r9=00000010 r10=00000511 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004C6 r9=00000010 r10=00000512 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300C2018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300C2018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004C7 r9=00000010 r10=00000513 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004C8 r9=00000010 r10=00000514 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004C9 r9=00000010 r10=00000515 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004CA r9=00000010 r10=00000516 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004CB r9=00000010 r10=00000517 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004CC r9=00000010 r10=00000518 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004CD r9=00000010 r10=00000519 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004CE r9=00000010 r10=0000051A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004CF r9=00000010 r10=0000051B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004D0 r9=00000010 r10=0000051C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004D1 r9=00000010 r10=0000051D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004D2 r9=00000010 r10=0000051E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=300B0018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=300B0018 prio=0 lr=824AAFC8 K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F800011C kevent_va=300B2018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F800011C kevent_va=300B2018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004D3 r9=00000010 r10=0000051F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004D4 r9=00000010 r10=00000520 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C4018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C4018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004D5 r9=00000010 r10=00000521 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004D6 r9=00000010 r10=00000522 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004D7 r9=00000010 r10=00000523 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004D8 r9=00000010 r10=00000524 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004D9 r9=00000010 r10=00000525 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004DA r9=00000010 r10=00000526 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004DB r9=00000010 r10=00000527 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004DC r9=00000010 r10=00000528 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C6018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C6018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004DD r9=00000010 r10=00000529 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004DE r9=00000010 r10=0000052A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004DF r9=00000010 r10=0000052B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004E0 r9=00000010 r10=0000052C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004E1 r9=00000010 r10=0000052D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004E2 r9=00000010 r10=0000052E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004E3 r9=00000010 r10=0000052F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004E4 r9=00000010 r10=00000530 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004E5 r9=00000010 r10=00000531 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004E6 r9=00000010 r10=00000532 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004E7 r9=00000010 r10=00000533 lr=822F1D5C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004E8 r9=00000010 r10=00000534 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004E9 r9=00000010 r10=00000535 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004EA r9=00000010 r10=00000536 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004EB r9=00000010 r10=00000537 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B4018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B4018 prio=0 lr=824AAFC8 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004EC r9=00000010 r10=00000538 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C8018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C8018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004ED r9=00000010 r10=00000539 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004EE r9=00000010 r10=0000053A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004EF r9=00000010 r10=0000053B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004F0 r9=00000010 r10=0000053C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004F1 r9=00000010 r10=0000053D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004F2 r9=00000010 r10=0000053E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004F3 r9=00000010 r10=0000053F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004F4 r9=00000010 r10=00000540 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004F5 r9=00000010 r10=00000541 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004F6 r9=00000010 r10=00000542 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004F7 r9=00000010 r10=00000543 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004F8 r9=00000010 r10=00000544 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004F9 r9=00000010 r10=00000545 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004FA r9=00000010 r10=00000546 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004FB r9=00000010 r10=00000547 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004FC r9=00000010 r10=00000548 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004FD r9=00000010 r10=00000549 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000004FE r9=00000010 r10=0000054A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000004FF r9=00000010 r10=0000054B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000500 r9=00000010 r10=0000054C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300CA018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300CA018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000501 r9=00000010 r10=0000054D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000502 r9=00000010 r10=0000054E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B6018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B6018 prio=0 lr=824AAFC8 K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B8018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B8018 prio=0 lr=824AAFC8 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000503 r9=00000010 r10=0000054F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000504 r9=00000010 r10=00000550 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000505 r9=00000010 r10=00000551 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000506 r9=00000010 r10=00000552 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000507 r9=00000010 r10=00000553 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000508 r9=00000010 r10=00000554 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000509 r9=00000010 r10=00000555 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000050A r9=00000010 r10=00000556 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000050B r9=00000010 r10=00000557 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000050C r9=00000010 r10=00000558 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000050D r9=00000010 r10=00000559 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000050E r9=00000010 r10=0000055A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BC018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BC018 prio=0 lr=824AAFC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000050F r9=00000010 r10=0000055B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000510 r9=00000010 r10=0000055C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000511 r9=00000010 r10=0000055D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000512 r9=00000010 r10=0000055E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000513 r9=00000010 r10=0000055F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000514 r9=00000010 r10=00000560 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000515 r9=00000010 r10=00000561 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000516 r9=00000010 r10=00000562 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000517 r9=00000010 r10=00000563 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000518 r9=00000010 r10=00000564 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000519 r9=00000010 r10=00000565 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000051A r9=00000010 r10=00000566 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000051B r9=00000010 r10=00000567 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F800012C kevent_va=300BA018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F800012C kevent_va=300BA018 prio=0 lr=824AAFC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000051C r9=00000010 r10=00000568 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000051D r9=00000010 r10=00000569 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000051E r9=00000010 r10=0000056A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000138 kevent_va=300BE018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000138 kevent_va=300BE018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000051F r9=00000010 r10=0000056B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000520 r9=00000010 r10=0000056C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000521 r9=00000010 r10=0000056D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000522 r9=00000010 r10=0000056E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000523 r9=00000010 r10=0000056F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000524 r9=00000010 r10=00000570 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000525 r9=00000010 r10=00000571 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000526 r9=00000010 r10=00000572 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000527 r9=00000010 r10=00000573 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000528 r9=00000010 r10=00000574 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000529 r9=00000010 r10=00000575 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000052A r9=00000010 r10=00000576 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000052B r9=00000010 r10=00000577 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000052C r9=00000010 r10=00000578 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000052D r9=00000010 r10=00000579 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000052E r9=00000010 r10=0000057A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300C0018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300C0018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000052F r9=00000010 r10=0000057B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000530 r9=00000010 r10=0000057C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000531 r9=00000010 r10=0000057D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000532 r9=00000010 r10=0000057E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000533 r9=00000010 r10=0000057F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=3007E018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000114 kevent_va=30080018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F8000114 kevent_va=30080018 prio=0 lr=824AAFC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000534 r9=00000010 r10=00000580 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000535 r9=00000010 r10=00000581 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000536 r9=00000010 r10=00000582 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000537 r9=00000010 r10=00000583 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000538 r9=00000010 r10=00000584 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000539 r9=00000010 r10=00000585 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000053A r9=00000010 r10=00000586 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000053B r9=00000010 r10=00000587 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000053C r9=00000010 r10=00000588 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300C2018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300C2018 prio=0 lr=824AAFC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000053D r9=00000010 r10=00000589 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000053E r9=00000010 r10=0000058A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000053F r9=00000010 r10=0000058B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000540 r9=00000010 r10=0000058C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000541 r9=00000010 r10=0000058D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000542 r9=00000010 r10=0000058E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000543 r9=00000010 r10=0000058F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=300B0018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=300B0018 prio=0 lr=824AAFC8 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000544 r9=00000010 r10=00000590 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000545 r9=00000010 r10=00000591 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000546 r9=00000010 r10=00000592 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000547 r9=00000010 r10=00000593 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000548 r9=00000010 r10=00000594 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000549 r9=00000010 r10=00000595 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000054A r9=00000010 r10=00000596 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C4018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C4018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000054B r9=00000010 r10=00000597 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000054C r9=00000010 r10=00000598 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000054D r9=00000010 r10=00000599 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000054E r9=00000010 r10=0000059A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000054F r9=00000010 r10=0000059B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000550 r9=00000010 r10=0000059C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000551 r9=00000010 r10=0000059D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000552 r9=00000010 r10=0000059E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000553 r9=00000010 r10=0000059F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000554 r9=00000010 r10=000005A0 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000555 r9=00000010 r10=000005A1 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000556 r9=00000010 r10=000005A2 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000557 r9=00000010 r10=000005A3 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000558 r9=00000010 r10=000005A4 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C6018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C6018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000559 r9=00000010 r10=000005A5 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000055A r9=00000010 r10=000005A6 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000055B r9=00000010 r10=000005A7 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000055C r9=00000010 r10=000005A8 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000055D r9=00000010 r10=000005A9 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000055E r9=00000010 r10=000005AA lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000055F r9=00000010 r10=000005AB lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000560 r9=00000010 r10=000005AC lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000561 r9=00000010 r10=000005AD lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000562 r9=00000010 r10=000005AE lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C8018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C8018 prio=0 lr=824AAFC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000563 r9=00000010 r10=000005AF lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000564 r9=00000010 r10=000005B0 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000565 r9=00000010 r10=000005B1 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000566 r9=00000010 r10=000005B2 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000567 r9=00000010 r10=000005B3 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000568 r9=00000010 r10=000005B4 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000001 r5=828F3888 r6=701CF924 r7=00000001 r8=00000569 r9=00000010 r10=000005B6 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000056A r9=00000010 r10=000005B7 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000056B r9=00000010 r10=000005B8 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000056C r9=00000010 r10=000005B9 lr=822F1D5C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000056D r9=00000010 r10=000005BA lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000056E r9=00000010 r10=000005BB lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000056F r9=00000010 r10=000005BC lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000570 r9=00000010 r10=000005BD lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000571 r9=00000010 r10=000005BE lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000572 r9=00000010 r10=000005BF lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000573 r9=00000010 r10=000005C0 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300CA018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300CA018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000574 r9=00000010 r10=000005C1 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000575 r9=00000010 r10=000005C2 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000576 r9=00000010 r10=000005C3 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000577 r9=00000010 r10=000005C4 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000578 r9=00000010 r10=000005C5 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000579 r9=00000010 r10=000005C6 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000057A r9=00000010 r10=000005C7 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000057B r9=00000010 r10=000005C8 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000057C r9=00000010 r10=000005C9 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000057D r9=00000010 r10=000005CA lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000057E r9=00000010 r10=000005CB lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000057F r9=00000010 r10=000005CC lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000580 r9=00000010 r10=000005CD lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000581 r9=00000010 r10=000005CE lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000582 r9=00000010 r10=000005CF lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000583 r9=00000010 r10=000005D0 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BC018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BC018 prio=0 lr=824AAFC8 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000584 r9=00000010 r10=000005D1 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC XEvent::Set handle=F80000C8 kevent_va=00000000 prio=1 lr=827E843C K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000585 r9=00000010 r10=000005D2 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000586 r9=00000010 r10=000005D3 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000587 r9=00000010 r10=000005D4 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000588 r9=00000010 r10=000005D5 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000589 r9=00000010 r10=000005D6 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000058A r9=00000010 r10=000005D7 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000058B r9=00000010 r10=000005D8 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000058C r9=00000010 r10=000005D9 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000058D r9=00000010 r10=000005DA lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000138 kevent_va=300BE018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000138 kevent_va=300BE018 prio=0 lr=824AAFC8 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000058E r9=00000010 r10=000005DB lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000058F r9=00000010 r10=000005DC lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300C0018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300C0018 prio=0 lr=824AAFC8 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000590 r9=00000010 r10=000005DD lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000591 r9=00000010 r10=000005DE lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300C2018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300C2018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000592 r9=00000010 r10=000005DF lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000593 r9=00000010 r10=000005E0 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C4018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C4018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000594 r9=00000010 r10=000005E1 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000595 r9=00000010 r10=000005E2 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000596 r9=00000010 r10=000005E3 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000597 r9=00000010 r10=000005E4 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000598 r9=00000010 r10=000005E5 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000599 r9=00000010 r10=000005E6 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000059A r9=00000010 r10=000005E7 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F800011C kevent_va=300B2018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F800011C kevent_va=300B2018 prio=0 lr=824AAFC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000059B r9=00000010 r10=000005E8 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000059C r9=00000010 r10=000005E9 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000059D r9=00000010 r10=000005EA lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C6018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C6018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000059E r9=00000010 r10=000005EB lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000059F r9=00000010 r10=000005EC lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005A0 r9=00000010 r10=000005ED lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005A1 r9=00000010 r10=000005EE lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005A2 r9=00000010 r10=000005EF lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005A3 r9=00000010 r10=000005F0 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005A4 r9=00000010 r10=000005F1 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005A5 r9=00000010 r10=000005F2 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C8018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C8018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005A6 r9=00000010 r10=000005F3 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005A7 r9=00000010 r10=000005F4 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005A8 r9=00000010 r10=000005F5 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005A9 r9=00000010 r10=000005F6 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005AA r9=00000010 r10=000005F7 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005AB r9=00000010 r10=000005F8 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300CA018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300CA018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005AC r9=00000010 r10=000005F9 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005AD r9=00000010 r10=000005FA lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005AE r9=00000010 r10=000005FB lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B4018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B4018 prio=0 lr=824AAFC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005AF r9=00000010 r10=000005FC lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005B0 r9=00000010 r10=000005FD lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005B1 r9=00000010 r10=000005FE lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BC018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BC018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005B2 r9=00000010 r10=000005FF lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005B3 r9=00000010 r10=00000600 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005B4 r9=00000010 r10=00000601 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005B5 r9=00000010 r10=00000602 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005B6 r9=00000010 r10=00000603 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005B7 r9=00000010 r10=00000604 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000138 kevent_va=300BE018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000138 kevent_va=300BE018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005B8 r9=00000010 r10=00000605 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005B9 r9=00000010 r10=00000606 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005BA r9=00000010 r10=00000607 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005BB r9=00000010 r10=00000608 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005BC r9=00000010 r10=00000609 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005BD r9=00000010 r10=0000060A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300C0018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300C0018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005BE r9=00000010 r10=0000060B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B6018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B6018 prio=0 lr=824AAFC8 K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B8018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B8018 prio=0 lr=824AAFC8 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005BF r9=00000010 r10=0000060C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005C0 r9=00000010 r10=0000060D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005C1 r9=00000010 r10=0000060E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005C2 r9=00000010 r10=0000060F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005C3 r9=00000010 r10=00000610 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300C2018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300C2018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005C4 r9=00000010 r10=00000611 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005C5 r9=00000010 r10=00000612 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005C6 r9=00000010 r10=00000613 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005C7 r9=00000010 r10=00000614 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005C8 r9=00000010 r10=00000615 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005C9 r9=00000010 r10=00000616 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C4018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C4018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005CA r9=00000010 r10=00000617 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005CB r9=00000010 r10=00000618 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005CC r9=00000010 r10=00000619 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005CD r9=00000010 r10=0000061A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005CE r9=00000010 r10=0000061B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005CF r9=00000010 r10=0000061C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C6018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C6018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005D0 r9=00000010 r10=0000061D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F800012C kevent_va=300BA018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F800012C kevent_va=300BA018 prio=0 lr=824AAFC8 K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=3007E018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005D1 r9=00000010 r10=0000061E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005D2 r9=00000010 r10=0000061F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005D3 r9=00000010 r10=00000620 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005D4 r9=00000010 r10=00000621 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005D5 r9=00000010 r10=00000622 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C8018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C8018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005D6 r9=00000010 r10=00000623 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005D7 r9=00000010 r10=00000624 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005D8 r9=00000010 r10=00000625 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005D9 r9=00000010 r10=00000626 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005DA r9=00000010 r10=00000627 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005DB r9=00000010 r10=00000628 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005DC r9=00000010 r10=00000629 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005DD r9=00000010 r10=0000062A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300CA018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300CA018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005DE r9=00000010 r10=0000062B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005DF r9=00000010 r10=0000062C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005E0 r9=00000010 r10=0000062D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005E1 r9=00000010 r10=0000062E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005E2 r9=00000010 r10=0000062F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005E3 r9=00000010 r10=00000630 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BC018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BC018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005E4 r9=00000010 r10=00000631 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000114 kevent_va=30080018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F8000114 kevent_va=30080018 prio=0 lr=824AAFC8 K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=300B0018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=300B0018 prio=0 lr=824AAFC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005E5 r9=00000010 r10=00000632 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005E6 r9=00000010 r10=00000633 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005E7 r9=00000010 r10=00000634 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005E8 r9=00000010 r10=00000635 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005E9 r9=00000010 r10=00000636 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005EA r9=00000010 r10=00000637 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005EB r9=00000010 r10=00000638 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005EC r9=00000010 r10=00000639 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005ED r9=00000010 r10=0000063A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000138 kevent_va=300BE018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000138 kevent_va=300BE018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005EE r9=00000010 r10=0000063B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005EF r9=00000010 r10=0000063C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005F0 r9=00000010 r10=0000063D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005F1 r9=00000010 r10=0000063E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005F2 r9=00000010 r10=0000063F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005F3 r9=00000010 r10=00000640 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300C0018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300C0018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005F4 r9=00000010 r10=00000641 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005F5 r9=00000010 r10=00000642 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005F6 r9=00000010 r10=00000643 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005F7 r9=00000010 r10=00000644 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005F8 r9=00000010 r10=00000645 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F800011C kevent_va=300B2018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F800011C kevent_va=300B2018 prio=0 lr=824AAFC8 K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B4018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B4018 prio=0 lr=824AAFC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005F9 r9=00000010 r10=00000646 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005FA r9=00000010 r10=00000647 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005FB r9=00000010 r10=00000648 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300C2018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300C2018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005FC r9=00000010 r10=00000649 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005FD r9=00000010 r10=0000064A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=000005FE r9=00000010 r10=0000064B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=000005FF r9=00000010 r10=0000064C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000600 r9=00000010 r10=0000064D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000601 r9=00000010 r10=0000064E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C4018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C4018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000602 r9=00000010 r10=0000064F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000603 r9=00000010 r10=00000650 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000604 r9=00000010 r10=00000651 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000605 r9=00000010 r10=00000652 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000606 r9=00000010 r10=00000653 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000607 r9=00000010 r10=00000654 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C6018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C6018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000608 r9=00000010 r10=00000655 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000609 r9=00000010 r10=00000656 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000060A r9=00000010 r10=00000657 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B6018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B6018 prio=0 lr=824AAFC8 K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B8018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B8018 prio=0 lr=824AAFC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000060B r9=00000010 r10=00000658 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000060C r9=00000010 r10=00000659 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000060D r9=00000010 r10=0000065A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000060E r9=00000010 r10=0000065B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000060F r9=00000010 r10=0000065C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C8018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C8018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000610 r9=00000010 r10=0000065D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000611 r9=00000010 r10=0000065E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000612 r9=00000010 r10=0000065F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000613 r9=00000010 r10=00000660 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000614 r9=00000010 r10=00000661 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000615 r9=00000010 r10=00000662 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300CA018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300CA018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000616 r9=00000010 r10=00000663 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000617 r9=00000010 r10=00000664 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000618 r9=00000010 r10=00000665 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000619 r9=00000010 r10=00000666 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000061A r9=00000010 r10=00000667 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000061B r9=00000010 r10=00000668 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BC018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BC018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000061C r9=00000010 r10=00000669 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F800012C kevent_va=300BA018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F800012C kevent_va=300BA018 prio=0 lr=824AAFC8 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000061D r9=00000010 r10=0000066A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000061E r9=00000010 r10=0000066B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000061F r9=00000010 r10=0000066C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000620 r9=00000010 r10=0000066D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000621 r9=00000010 r10=0000066E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000138 kevent_va=300BE018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000138 kevent_va=300BE018 prio=0 lr=824AAFC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000622 r9=00000010 r10=0000066F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000623 r9=00000010 r10=00000670 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=00000000 prio=1 lr=824D0C6C K> F800006C AUDIT-HLC XEvent::Set handle=F80000C0 kevent_va=00000000 prio=1 lr=824D08C0 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000624 r9=00000010 r10=00000671 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000625 r9=00000010 r10=00000672 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000626 r9=00000010 r10=00000673 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000627 r9=00000010 r10=00000674 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000628 r9=00000010 r10=00000675 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000629 r9=00000010 r10=00000676 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300C0018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300C0018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000062A r9=00000010 r10=00000677 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000062B r9=00000010 r10=00000678 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000062C r9=00000010 r10=00000679 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000062D r9=00000010 r10=0000067A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000062E r9=00000010 r10=0000067B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000062F r9=00000010 r10=0000067C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000630 r9=00000010 r10=0000067D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000631 r9=00000010 r10=0000067E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300C2018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300C2018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000110 kevent_va=3007E018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F8000110 kevent_va=3007E018 prio=0 lr=824AAFC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000632 r9=00000010 r10=0000067F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000633 r9=00000010 r10=00000680 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000634 r9=00000010 r10=00000681 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000635 r9=00000010 r10=00000682 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000636 r9=00000010 r10=00000683 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000637 r9=00000010 r10=00000684 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C4018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C4018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000638 r9=00000010 r10=00000685 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000639 r9=00000010 r10=00000686 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000063A r9=00000010 r10=00000687 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000063B r9=00000010 r10=00000688 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000063C r9=00000010 r10=00000689 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000063D r9=00000010 r10=0000068A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C6018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C6018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000063E r9=00000010 r10=0000068B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000063F r9=00000010 r10=0000068C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000640 r9=00000010 r10=0000068D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000641 r9=00000010 r10=0000068E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000642 r9=00000010 r10=0000068F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000114 kevent_va=30080018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F8000114 kevent_va=30080018 prio=0 lr=824AAFC8 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000643 r9=00000010 r10=00000690 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C8018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C8018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000644 r9=00000010 r10=00000691 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000645 r9=00000010 r10=00000692 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000646 r9=00000010 r10=00000693 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000647 r9=00000010 r10=00000694 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000648 r9=00000010 r10=00000695 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000649 r9=00000010 r10=00000696 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000150 kevent_va=300CA018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000150 kevent_va=300CA018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000064A r9=00000010 r10=00000697 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000064B r9=00000010 r10=00000698 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000064C r9=00000010 r10=00000699 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000064D r9=00000010 r10=0000069A lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000064E r9=00000010 r10=0000069B lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000064F r9=00000010 r10=0000069C lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000650 r9=00000010 r10=0000069D lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000651 r9=00000010 r10=0000069E lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000134 kevent_va=300BC018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000134 kevent_va=300BC018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000652 r9=00000010 r10=0000069F lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000653 r9=00000010 r10=000006A0 lr=822F1D5C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000654 r9=00000010 r10=000006A1 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000118 kevent_va=300B0018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F8000118 kevent_va=300B0018 prio=0 lr=824AAFC8 K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F800011C kevent_va=300B2018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F800011C kevent_va=300B2018 prio=0 lr=824AAFC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000655 r9=00000010 r10=000006A2 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000656 r9=00000010 r10=000006A3 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000657 r9=00000010 r10=000006A4 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000138 kevent_va=300BE018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000138 kevent_va=300BE018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000658 r9=00000010 r10=000006A5 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000659 r9=00000010 r10=000006A6 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000065A r9=00000010 r10=000006A7 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000065B r9=00000010 r10=000006A8 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000065C r9=00000010 r10=000006A9 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000065D r9=00000010 r10=000006AA lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800013C kevent_va=300C0018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F800013C kevent_va=300C0018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000065E r9=00000010 r10=000006AB lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000065F r9=00000010 r10=000006AC lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000660 r9=00000010 r10=000006AD lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000661 r9=00000010 r10=000006AE lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000662 r9=00000010 r10=000006AF lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000663 r9=00000010 r10=000006B0 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000664 r9=00000010 r10=000006B1 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000665 r9=00000010 r10=000006B2 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000140 kevent_va=300C2018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000140 kevent_va=300C2018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000666 r9=00000010 r10=000006B3 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000120 kevent_va=300B4018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F8000120 kevent_va=300B4018 prio=0 lr=824AAFC8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000667 r9=00000010 r10=000006B4 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000668 r9=00000010 r10=000006B5 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000669 r9=00000010 r10=000006B6 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000066A r9=00000010 r10=000006B7 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000066B r9=00000010 r10=000006B8 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000144 kevent_va=300C4018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000144 kevent_va=300C4018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000066C r9=00000010 r10=000006B9 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000066D r9=00000010 r10=000006BA lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000066E r9=00000010 r10=000006BB lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000066F r9=00000010 r10=000006BC lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000670 r9=00000010 r10=000006BD lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000671 r9=00000010 r10=000006BE lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000672 r9=00000010 r10=000006BF lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000673 r9=00000010 r10=000006C0 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000674 r9=00000010 r10=000006C1 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000675 r9=00000010 r10=000006C2 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000676 r9=00000010 r10=000006C3 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000677 r9=00000010 r10=000006C4 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F8000148 kevent_va=300C6018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F8000148 kevent_va=300C6018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000678 r9=00000010 r10=000006C5 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000124 kevent_va=300B6018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F8000124 kevent_va=300B6018 prio=0 lr=824AAFC8 K> F8000154 AUDIT-HLC NtReadFile_signal_event handle=F8000128 kevent_va=300B8018 lr=824AAFC8 K> F8000154 AUDIT-HLC XEvent::Set handle=F8000128 kevent_va=300B8018 prio=0 lr=824AAFC8 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000679 r9=00000010 r10=000006C6 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000067A r9=00000010 r10=000006C7 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000067B r9=00000010 r10=000006C8 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000067C r9=00000010 r10=000006C9 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000067D r9=00000010 r10=000006CA lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000067E r9=00000010 r10=000006CB lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000067F r9=00000010 r10=000006CC lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000680 r9=00000010 r10=000006CD lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000681 r9=00000010 r10=000006CE lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000682 r9=00000010 r10=000006CF lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F8000070 AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F8000070 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000683 r9=00000010 r10=000006D0 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000684 r9=00000010 r10=000006D1 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000685 r9=00000010 r10=000006D2 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000686 r9=00000010 r10=000006D3 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000687 r9=00000010 r10=000006D4 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=00000688 r9=00000010 r10=000006D5 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=00000689 r9=00000010 r10=000006D6 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000068A r9=00000010 r10=000006D7 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000068B r9=00000010 r10=000006D8 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 K> F8000064 AUDIT-HLC XEvent::Set handle=F8000178 kevent_va=00000000 prio=1 lr=82508358 K> F8000158 AUDIT-HLC NtReadFile_signal_event handle=F800014C kevent_va=300C8018 lr=824AAFC8 K> F8000158 AUDIT-HLC XEvent::Set handle=F800014C kevent_va=300C8018 prio=0 lr=824AAFC8 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C K> F8000158 AUDIT-HLC XEvent::Set handle=F8000174 kevent_va=00000000 prio=1 lr=82506F9C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000001 r8=0000068C r9=00000010 r10=000006D9 lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 K> F800006C AUDIT-HLC XEvent::Set handle=F8000180 kevent_va=00000000 prio=1 lr=82508510 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 K> F800006C AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82508524 K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 K> F8000154 AUDIT-HLC XEvent::Set handle=F800017C kevent_va=00000000 prio=1 lr=82506C90 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44 K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C K> F800006C AUDIT-HLC XEvent::Set handle=F800007C kevent_va=00000000 prio=1 lr=824D292C K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 guest_lr=824BEAAC K> 01000014 AUDIT-HLC XEvent::Set handle=F800005C kevent_va=30053018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000000 r5=828F3888 r6=701CF924 r7=00000000 r8=0000068D r9=00000010 r10=000006DA lr=822F1D5C K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00000000 00000000 000003E8 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 BC365F80 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 00000000 00000000 BC366200 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000008 0000001E 00000002 BDE9A398 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365580 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F8000048 00000000 00000000 BC3656A0 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC365220 00000000 00000000 00000000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 guest_lr=822F1D5C K> F8000008 AUDIT-HLC XEvent::Set handle=F800000C kevent_va=30029018 prio=0 lr=824AA304 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 guest_lr=8216EE14 K> F8000008 AUDIT-HLC XEvent::Set handle=F8000060 kevent_va=30055018 prio=0 lr=824AA304 K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 K> 0100001C AUDIT-HLC XEvent::Set handle=F8000074 kevent_va=00000000 prio=1 lr=824D2A44